T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build-dataify-request.py:66- Finding
Shell Command Injection Through Unescaped Scraper Parameters
- Content
View full analysis
List[Dict[str, Any]]: param_defs = {item["param"]: item for item in tool.get("params", [])} mapped_rows: List[Dict[str, Any]] = [] for row in rows: mapped: Dict[str, Any] = {} for key, value in row.items(): param_def = param_defs.get(key) final_value = value if param_def and param_def.get("input_mode") == "select": for option in param_def.get("options", []): if value in { option.get("label"), option.get("submitted_value"), option.get("raw_value"), option.get("raw_type_value"), }: final_value = option.get("submitted_value") break mapped[key] = final_value mapped_rows.append(mapped) return mapped_rows ``` ```python def build_curl(tool: Dict[str, Any], spider_parameters_json: str) -> str: token = os.environ.get("DATAIFY_API_TOKEN", "").strip() if not token: raise SystemExit( "DATAIFY_API_TOKEN is not set. Sign in at https://dashboard.dataify.com?utm_source=skill to obtain it, then export it as an environment variable." ) parts = [ "curl -X POST 'https://scraperapi.dataify.com/builder'", f" -H 'Authorization: Bearer {token}'", " -H 'Content-Type: application/x-www-form-urlencoded'", f" -d 'spider_name={tool['spider_name']}'", f" -d 'spider_id={tool['tool_sign']}'", f" -d 'spider_parameters={spider_parameters_json}'", " -d 'spider_errors=true'", " -d ...[truncated 3058 chars]- Remediation
View remediation