T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:183- Finding
Arbitrary Code Execution Through User-Controlled Pandas Query
- Content
View full analysis
value' or 'column == \"string\"'") return df ``` ### Technical Analysis The `--where` command-line argument, or the condition entered in interactive mode, is passed to `DataFrame.query()` using the Python evaluation engine. This makes the filtering expression an executable expression rather than a strictly parsed comparison. The preceding substring blacklist is not an adequate security boundary. It only rejects expressions containing `import`, `exec`, `eval`, or `__`. It does not enforce a grammar or prevent access to other objects and callable attributes available through the pandas evaluation environment. A crafted expression can therefore invoke a reachable dangerous function without containing any blocked substring. Even if the resulting expression is not a valid boolean filter, its side effects may occur before pandas reports an error. ### Attack Path 1. An attacker controls a condition supplied through `filter --where` or convinces a user or automation agent to process an attacker-provided condition. 2. The attacker constructs a pandas expression that reaches a command-execution function through an object available to the query environment while avoiding the four blocked substrings. 3. The blacklist accepts the expression. 4. `df.query(condition, engine='python')` evaluates it in the local Python pro ...[truncated 825 chars]- Remediation
View remediation
numeric_value`. - Reject function calls, attribute access, indexing into arbitrary objects, `@` references, and all syntax outside the supported grammar. - Return a failure rather than the original unfiltered DataFrame when a condition is invalid. Returning the full dataset can cause unintended disclosure or export. - Add regression tests containing known expression-injection patterns and verify that no callable object can be reached. - If a third-party expression parser is used, configure an explicit AST-node allowlist and ensure that evaluation cannot access Python globals, locals, built-ins, or object attributes. ]]>