T09 · Insecure Skill Coding Practices
Note
- Location
scripts/script.sh:105- Finding
Search Term Option Injection in grep Invocation
- Content
View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The user-controlled search term is passed to `grep` without an end-of-options delimiter: ```bash grep -i "$term" "$f" ``` Shell quoting prevents word splitting and shell command injection, but it does not prevent `grep` from interpreting a value beginning with `-` as a command-line option. Consequently, an attacker can change how `grep` processes the command rather than supplying a literal search pattern. For example, a term such as `-f` can cause the following log-file argument to be interpreted as a pattern file. Other supported `grep` options may change matching, file handling, output, or resource-consumption behavior. The `2>/dev/null || true` construct suppresses diagnostic output and failure status, making this manipulation less visible. This issue does not provide arbitrary shell command execution because the value remains quoted and is not passed through `eval` or a shell interpreter. ### Attack Path 1. An attacker or untrusted caller supplies a search term beginning with a hyphen: ```bash dev-setup search -f ``` 2. `_search` assigns `-f` to `term`. 3. The script executes an effective command resembling: ```bash grep -i -f "/home/user/.local/share/dev-setup/run.log" ``` 4. `grep` treats the log path as a pattern-file operand rather than treating `-f` as the literal pattern. 5. Search behavior is altered, and errors are hidden by stderr redirection and `|| tr ...[truncated 484 chars]- Remediation
View remediation
/dev/null || true) ``` Additional hardening measures: 1. Validate that the term does not contain prohibited control characters. 2. Retain quoting around both the pattern and file path. 3. Avoid suppressing all errors when operational visibility is important. 4. Add regression tests using values such as `-f`, `--help`, `--`, spaces, and newline characters to confirm that every supplied term is treated only as a literal pattern. ]]>