T09 · Insecure Skill Coding Practices
Error
- Location
scripts/es_search.sh:40- Finding
Shell Command Injection Through eval in the Bash Wrapper
- Content
View full analysis
&1) echo "$output" | jq -R 'split("\n") | map(select(length > 0)) | map({path: .})' 2>/dev/null || echo "$output" else # Output as text eval "$cmd" fi ``` ### Technical Analysis The script initially constructs the command as a Bash array, which would normally preserve argument boundaries. However, `build_cmd` serializes that array into a plain string using `echo`, and the caller subsequently executes the string with `eval`. Values controlled by the caller—including the search query, path, sort field, and `ES_PATH` environment variable—therefore undergo a second round of shell parsing. Shell separators, substitutions, redirections, and other metacharact ...[truncated 1445 chars]- Remediation
View remediation
&1) else "${cmd[@]}" fi ``` - Do not return arrays through `echo` and command substitution. - Resolve `ES_PATH` to an approved executable and reject unexpected executable paths where the environment is not fully trusted. - Validate options that have a finite set of permitted values, such as sort fields. - Add regression tests containing spaces, semicolons, command substitutions, redirections, and quotes to verify that every supplied value remains a single literal argument. ]]>