T09 · Insecure Skill Coding Practices
- Location
scripts/analyze_logs.py:550- Finding
Terminal Control-Sequence Injection Through Untrusted Log Messages
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyze_logs.py, lines 550-555
Vulnerability Type: Terminal output injection
Risk Level: MediumVulnerable code snippet:
python for i, p in enumerate(result['patterns'], 1): sev = p['severity_label'] out.append(f'[{sev}] #{i} — {p["count"]:,}x occurrences') out.append(f' Message: {p["message"][:200]}')Technical Analysis
Log messages are attacker-controlled data in many realistic deployments, including HTTP headers, request paths, usernames, exception values, and messages received from external services. The text formatter inserts this data directly into terminal output without escaping ASCII control characters, ANSI escape sequences, carriage returns, or other non-printable characters.
A crafted message containing characters such as
ESC [ 2 J,ESC [ H, carriage return, or terminal-specific OSC sequences will be interpreted by a compatible terminal rather than displayed as inert text. This can clear or overwrite visible output, disguise malicious entries, create deceptive links, or otherwise alter the presentation of the audit report. Some terminal configurations support additional OSC operations, but arbitrary command execution is not established by the audited code and depends on the terminal implementation.Truncating the message to 200 characters does not mitigate the issue because functional terminal sequences are usually only a few bytes long.
Attack Path
- An attacker causes an application to record attacker-controlled data in a log message.
- The attacker embeds terminal control characters in that data, for example an ANSI sequence that clears the screen followed by a forged clean-status message.
- A user runs the analyzer with its default text output against the affected log file.
format_text()places the raw message in the generated output.print()sends the resulting control sequence to the user' ...[truncated 592 chars]
- Remediation
View remediation
Remediation Suggestions
- Sanitize all log-derived text before writing it to an interactive terminal.
- Remove or visibly encode C0/C1 control characters, especially
\x1b,\r,\b, and terminal OSC terminators. - Preserve safe formatting characters only where explicitly required; encode unsafe bytes with representations such as
\x1bor\u001b. - Apply sanitization at the final output boundary so every terminal-facing field, including messages and source names, receives consistent protection.
- Consider a helper such as:
python def sanitize_terminal(value): return ''.join( ch if ch in '\n\t' or ord(ch) >= 0x20 else f'\\x{ord(ch):02x}' for ch in str(value) ).replace('\x1b', r'\x1b').replace('\r', r'\r') - If multiline values are unnecessary in text reports, replace newlines and tabs with visible escaped forms as well.
- Add regression tests using ANSI clear-screen sequences, carriage-return overwrites, OSC hyperlinks, and other non-printable input.