T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/shortcut-init-workflow.sh:19- Finding
API-Controlled Workflow Names Are Converted into Persistent Shell Code
- Content
View full analysis
"$CONFIG_DIR/workflow-states" << 'EOF' # Shortcut workflow state IDs for your workspace # Generated by shortcut-init-workflow.sh # Edit these to match your workspace's actual state IDs EOF echo "$STATES" | jq -r '.[] | .states[] | "export SHORTCUT_STATE_\(.name | ascii_upcase | gsub(" "; "_"))=\(.id)"' >> "$CONFIG_DIR/workflow-states" ``` The generated file is subsequently executed: ```bash if [ -f ~/.config/shortcut/workflow-states ]; then source ~/.config/shortcut/workflow-states ``` The documentation also recommends persistent execution from shell startup: ```bash export SHORTCUT_API_TOKEN=$(cat ~/.config/shortcut/api-token 2>/dev/null | tr -d '\n') source ~/.config/shortcut/workflow-states ``` ### Technical Analysis The initialization script retrieves workflow objects from the Shortcut API and embeds each remote workflow state name directly into a shell variable declaration. The only transformation applied to the name is uppercasing and replacement of spaces with underscores. This does not reject shell metacharacters, command substitutions, quotes, line breaks, or other characters that can change the meaning of the generated shell file. The resulting file is not treated as passive configuration: `shortcut-update-story.sh` executes it with `source`, and the documentation recommends sourcing it from `.bashrc`. Consequently, a party capable of controlling a workflow state name in the associated Shortcut workspace may be able to place shell syntax in `~/.config/ ...[truncated 1759 chars]- Remediation
View remediation
"$CONFIG_FILE" chmod 600 "$CONFIG_FILE" ``` 2. Read the required ID with `jq` rather than `source`: ```bash STATE_DONE=$(jq -er ' .[] | select(.name == "Done") | .id ' "$HOME/.config/shortcut/workflow-states.json") ``` 3. Validate every retrieved ID as an integer before using it: ```bash [[ "$STATE_DONE" =~ ^[0-9]+$ ]] || { echo "Invalid workflow state ID" >&2 exit 1 } ``` 4. Remove all instructions recommending that API-derived files be sourced from `.bashrc`. 5. If shell-format configuration must be retained, use fixed local variable names rather than names derived from remote state names, strictly validate values, shell-escape them with `printf '%q'`, reject unexpected input, and create the file with mode `0600`. Passive JSON remains the safer design. ]]>