T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_event.sh:39- Finding
AppleScript Injection Through Incomplete Escaping of Untrusted Arguments
- Content
View full analysis
&1 on run set eventTitle to "$T_E" set calName to "$C_E" set locStr to "$L_E" set notesStr to "$N_E" ``` `scripts/create_reminder.sh:49-54`: ```bash esc() { printf '%s' "$1" | sed 's/"/\\"/g'; } T_E=$(esc "$TITLE"); L_E=$(esc "$LIST") /usr/bin/osascript <&1 on run set t to "$T_E" set lName to "$L_E" ``` `scripts/find_event.sh:40-43`: ```bash esc() { printf '%s' "$1" | sed 's/"/\\"/g'; } C_E=$(esc "$CAL"); K_E=$(esc "$KW") /usr/bin/osascript <&1 on run set calName to "$C_E" set kw to "$K_E" ``` `scripts/update_event.sh:60-71`: ```bash esc() { local s="${1//\"/\\\"}" out="" line while IFS= read -r line; do [ -n "$out" ] && out+='" & linefeed & "' out+="$line" done <<< "$s" printf '%s' "$out" } K_E=$(esc "$KEY"); T_E=$(esc "$TITLE"); L_E=$(esc "$LOC"); N_E=$(esc "$NOTES") /usr/bin/osascript <&1 on run set keyStr to "$K_E" set titleStr to "$T_E" set locStr to "$L_E" set notesStr to "$N_E" ``` ### Technical Analysis The scripts generate AppleScript source through unquoted heredocs and interpolate values derived from command-line arguments directly into AppleScript string literals. These arguments can include event titles, notes, locations, calendar names, reminder-list names, search keywords, and event identifiers. The escaping functions only add a backslash b ...[truncated 2272 chars]- Remediation
View remediation