T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:151- Finding
Log Injection Through Unvalidated Multiline Input
- Content
View full analysis
> "$DATA_DIR/scan.log" local total=$(wc -l < "$DATA_DIR/scan.log") echo " [Diskmon] scan: $input" echo " Saved. Total scan entries: $total" _log "scan" "$input" fi ``` The same unsafe storage pattern is used for the `monitor`, `report`, `alert`, `top`, `usage`, `check`, `fix`, `cleanup`, `backup`, `restore`, `log`, `benchmark`, and `compare` commands. ### Technical Analysis Caller-controlled input is appended directly to line-oriented log files without rejecting or encoding carriage returns, line feeds, or the `|` field delimiter. Quoting the shell variable prevents shell command injection, but it does not make the value safe for the custom log format. An argument containing an embedded newline can create additional apparent records. Delimiter characters can also make records ambiguous to downstream consumers. Because these files are presented as historical and audit-ready records, an attacker who can supply a command argument can corrupt the integrity of the recorded history. ### Attack Path 1. An attacker or untrusted automation supplies a multiline value to a data command, for example: ```bash diskmon alert $'Normal observation\n2026-09-12 12:00|FALSE: cleanup completed' ``` 2. The script expands the argument inside `echo` and preserves the embedded newline. 3. Multiple physical lines are appended to `alert.log` and related history output. 4. Subsequent `recent`, `search`, `stats`, or `export` operations treat the injected line as an independent or malformed record. 5. A reviewer may rely on the forged entry as authentic monitoring or maintenance history ...[truncated 539 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Avoid an ambiguous custom delimiter format. Prefer a structured serializer such as JSON Lines generated by `jq`. 3. If the existing format must be retained, encode or escape backslashes, carriage returns, line feeds, and `|` characters before storage. 4. Decode values only through a corresponding, well-defined parser. 5. Apply the validation in a shared logging function so every data command receives identical protection. 6. Add tests covering embedded newlines, carriage returns, delimiters, quotes, backslashes, and empty values. ]]>