T09 · Insecure Skill Coding Practices
- Location
scripts/vsum.sh:24- Finding
Unvalidated Video URL Permits yt-dlp Option Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/vsum.sh, lines 24–31 and 47–52
Vulnerability Type: Improper input validation and argument injection
Risk Level: MediumVulnerable Code
bash # Detect the platform detect_platform() { if echo "$URL" | grep -q "bilibili.com"; then echo "bilibili" elif echo "$URL" | grep -q "youtube.com\|youtu.be"; then echo "youtube" else echo "unknown" fi }bash # Retrieve subtitles if [ "$PLATFORM" = "youtube" ]; then echo "Retrieving YouTube subtitles..." yt-dlp --write-auto-subs --sub-lang "$LANG" --skip-download "$URL" elif [ "$PLATFORM" = "bilibili" ]; then echo "Retrieving Bilibili subtitles (login required)..." yt-dlp --cookies-from-browser chrome --write-subs --sub-lang ai-zh,zh-CN,"$LANG" --skip-download "$URL" fiTechnical Analysis
The script treats input as a supported video URL whenever it contains the text
youtube.com,youtu.be, orbilibili.com. It does not parse the URL, validate its scheme and hostname, or reject values beginning with a hyphen.Although
"$URL"is shell-quoted, quoting only prevents shell word splitting and shell metacharacter interpretation. It does not stop the invoked program from interpreting the resulting argument as an option. Because the script does not place the--end-of-options delimiter before"$URL", a crafted value beginning with-can be parsed as ayt-dlpoption rather than as a video URL.For example, an attacker can submit an option-shaped value containing one of the accepted domain strings in an option parameter or path. Depending on the selected
yt-dlpoption and accessible local resources, this can alter configuration loading, batch input, output handling, network behavior, or command-hook behavior. Some exploitation variants require an attacker-controlled local configuration or batch file, but the script itse ...[truncated 2394 chars]- Remediation
View remediation
Remediation Suggestions
-
Terminate option parsing before the URL. Add
--immediately before the positional URL in both invocations:bash yt-dlp --write-auto-subs --sub-lang "$LANG" --skip-download -- "$URL"bash yt-dlp --cookies-from-browser chrome \ --write-subs \ --sub-lang "ai-zh,zh-CN,$LANG" \ --skip-download \ -- "$URL" -
Reject option-shaped input explicitly.
bash case "$URL" in -*) echo "Error: the URL must not begin with '-'." >&2; exit 1 ;; esac -
Validate the parsed URL rather than searching for domain substrings. Require HTTPS and compare the normalized hostname against an explicit allowlist. Approved hosts should include only the exact domains and subdomains intentionally supported, such as
youtube.com,www.youtube.com,youtu.be,bilibili.com, andwww.bilibili.com. -
Reject misleading host constructions. Do not accept a URL merely because an approved domain appears in its path, query string, fragment, or user-information component. Reject embedded credentials such as
https://youtube.com@untrusted.example/. -
Minimize browser-cookie access. Invoke
--cookies-from-browser chromeonly after confirming that the parsed hostname is an approved Bilibili host. Where possible, use a dedicated, least-privileged cookie file or browser profile rather than the user's general Chrome profile. -
Validate the language argument. Restrict the optional language value to the character set and format expected by
yt-dlp, even though it is currently supplied as the value of a fixed option. -
Add negative security tests. Test values beginning with
-, URLs containing approved domains only in their path or query, user-information hostname tricks, malformed URLs, unsupported schemes, and deceptive subdomains such asyoutube.com.attacker.example.
-