T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:71
- Finding
- Curl Startup Configuration Can Override Authenticated Request Security<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 71–101 **Vulnerability Type**: Untrusted curl startup configuration **Risk Level**: Medium ### Vulnerable Code ```sh # Keep the API key out of the curl process command line. A private temporary # config supplies the header and is removed automatically on exit. curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")" chmod 600 "$curl_config" trap 'rm -f "$curl_config"' EXIT printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config" auth=(--config "$curl_config") if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] || continue # curl treats both @file and name@file forms as local-file input for # --data-urlencode. Reject @ outright so query arguments cannot disclose # local files to the Crawlora API. case "$kv" in *@*) echo "@ is not allowed in query arguments" >&2; exit 2 ;; esac qs+=(--data-urlencode "$kv") done curl -fsS -G "${auth[@]}" ${qs[@]+"${qs[@]}"} "${base}${path}" else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis Curl normally loads its default startup configuration, such as the invoking user's `.curlrc`, before processing command-line arguments. The script does not place `-q` or `--disable` as the first curl argument, so settings from that external configuration remain active. Although the API base URL is hardcoded, a malicious startup configuration can influence security-sensitive behavior such as proxy selection, hostname resolution, TLS certificate verif ...[truncated 1884 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable curl's automatic startup configuration by making `-q` the first argument in every curl invocation: ```sh curl -q -fsS -G "${auth[@]}" \ ${qs[@]+"${qs[@]}"} "${base}${path}" ``` ```sh printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" \ --data-binary @- "${base}${path}" ``` 2. Run the helper in a controlled environment and clear curl-related configuration variables where practical. 3. Preserve strict TLS verification. Do not allow `--insecure`, attacker-controlled proxy settings, or untrusted hostname-resolution overrides. 4. Consider adding explicit connection controls, such as an HTTPS-only protocol policy and restricted redirect behavior: ```sh --proto '=https' --proto-redir '=https' --max-redirs 0 ``` 5. Add an automated regression test using a malicious temporary `.curlrc` and verify that its proxy, TLS, and additional-transfer directives are ignored. ]]>