T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/script.sh:522
- Finding
- Regex Injection in Prompt Name Matching Can Remove Unrelated Records<![CDATA[ ## Vulnerability Details **File Location**: `scripts/script.sh:522-529` **Vulnerability Type**: Regex injection and unsafe file update **Risk Level**: Medium ### Vulnerable Code ```bash # Check for duplicate name if grep -q "^${name}|" "$PROMPTS_FILE" 2>/dev/null; then echo "⚠️ A prompt named '$name' already exists. Overwriting." local tmp tmp=$(grep -v "^${name}|" "$PROMPTS_FILE") echo "$tmp" > "$PROMPTS_FILE" fi echo "${name}|${prompt}" >> "$PROMPTS_FILE" ``` ### Technical Analysis The user-controlled `name` value is interpolated directly into a Basic Regular Expression passed to `grep`. Regex metacharacters such as `.`, `*`, `[`, `]`, `^`, and `$` are not escaped. Consequently, a supplied name can match records other than the intended exact prompt name. The same injected expression is used by `grep -v` when rebuilding the prompt database, causing all matching records to be removed. The update is also non-atomic: the complete database is captured in a shell variable and then rewritten directly. An interruption during the rewrite can leave the file incomplete. ### Attack Path 1. Populate `prompts.txt` with multiple records, including names beginning with a common prefix such as `alpha` and `archive`. 2. Invoke the save command with a regex-bearing name: ```bash image-prompt save 'a.*' 'replacement prompt' ``` 3. The duplicate check evaluates the pattern `^a.*|`, which matches multiple existing records rather than one literal name. 4. `grep -v` removes every matching record while retaining nonmatching records. 5. The script rewrites the database and appends the attacker-supplied record. 6. Unrelated saved prompts matching the injected expression are lost. ### Impact Assessment Exploitation is limited to the invoking user's configured prompt database. It can delete or corrupt unrelated saved prompt records but does not grant additional operating-system privileges, execute commands, or access remote systems. The im ...[truncated 131 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use attacker-controlled values as regular expressions. - Validate prompt names against a restrictive format, such as: ```bash if [[ ! "$name" =~ ^[A-Za-z0-9._-]+$ ]]; then printf '%s\n' "Invalid prompt name" >&2 return 1 fi ``` - Compare the first field literally instead of interpolating it into `grep`: ```bash awk -F '|' -v target="$name" '$1 != target' "$PROMPTS_FILE" ``` - Write updates to a secure temporary file in the same directory and atomically rename it: ```bash tmp_file=$(mktemp "$DATA_DIR/prompts.XXXXXX") awk -F '|' -v target="$name" '$1 != target' "$PROMPTS_FILE" > "$tmp_file" printf '%s|%s\n' "$name" "$prompt" >> "$tmp_file" mv -- "$tmp_file" "$PROMPTS_FILE" ``` - Install a trap to remove the temporary file if the operation is interrupted. ]]>