T09 · Insecure Skill Coding Practices
Error
- Location
update_note.sh:3- Finding
AppleScript Injection Through Unsanitized Note Title
- Content
View full analysis
"$TMP_FILE" osascript <- Remediation
View remediation
&2 exit 2 fi NOTE_TITLE=$1 NEW_BODY=$2 TMP_FILE=$(mktemp) trap 'rm -f -- "$TMP_FILE"' EXIT HUP INT TERM printf '%s' "$NEW_BODY" > "$TMP_FILE" osascript - "$NOTE_TITLE" "$TMP_FILE" <<'APPLESCRIPT' on run argv set noteTitle to item 1 of argv set temporaryPath to item 2 of argv set newBodyFilePath to (POSIX file temporaryPath) as alias set fileRef to missing value try set fileRef to open for access newBodyFilePath set theContent to read fileRef as «class utf8» close access fileRef set fileRef to missing value tell application "Notes" set matchingNotes to notes whose name is noteTitle if (count of matchingNotes) is not 1 then error "Expected exactly one note with the supplied title." end if set body of item 1 of matchingNotes to theContent end tell on error errorMessage number errorNumber if fileRef is not missing value then try close access fileRef end try end if error errorMessage number errorNumber end try end run APPLESCRIPT ``` Additional hardening measures include: - Validate that exactly two arguments are supplied. - Use `set -euo pipefail` to stop on failures and unset variables. - Use `printf '%s'` instead of `echo` so content beginning with options or containing escape sequences is handled consistently. - Register a cleanup trap immediately after creating the temporary ...[truncated 231 chars]