T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/systemd-unit-generator.py:71- Finding
Unsanitized CLI values allow systemd unit directive injection
- Content
View full analysis
str: lines = ['[Unit]'] lines.append(f"Description={opts.get('description', opts.get('name', 'Service'))}") if opts.get('after'): lines.append(f"After={opts['after']}") if opts.get('wants'): lines.append(f"Wants={opts['wants']}") lines.append('') lines.append('[Service]') lines.append(f"Type={opts.get('type', 'simple')}") if opts.get('user'): lines.append(f"User={opts['user']}") if opts.get('group'): lines.append(f"Group={opts['group']}") if opts.get('workdir'): lines.append(f"WorkingDirectory={opts['workdir']}") # Environment envs = opts.get('env', {}) if isinstance(envs, dict): for k, v in envs.items(): lines.append(f"Environment={k}={v}") elif isinstance(envs, list): for e in envs: lines.append(f"Environment={e}") lines.append(f"ExecStart={opts.get('exec', '/usr/bin/echo hello')}") if opts.get('exec_stop'): lines.append(f"ExecStop={opts['exec_stop']}") if opts.get('exec_reload'): lines.append(f"ExecReload={opts['exec_reload']}") ``` ### Technical Analysis Values received from command-line options are interpolated directly into systemd unit directives without rejecting line breaks, NUL characters, or other control characters. The affected values include descriptions, dependencies, users, groups, working directories, environment variables, and executable directives. Systemd unit files are line-oriented. Consequently, an attacker-controlled newline terminates the intended directive and allows another directive to be inserted into the same section. For example, an environment argument containing a newline followed by ` ...[truncated 1835 chars]- Remediation
View remediation