T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dm-poll-notify.sh:24- Finding
Command Injection Through Unvalidated Arithmetic Input
- Content
View full analysis
[parent_session_key] [max_timeout_minutes]" exit 3 fi # 轮询间隔（秒）：递增策略 INTERVALS=(5 10 20 40 60) interval_idx=0 total_seconds=0 max_seconds=$((MAX_TIMEOUT * 60)) ``` `scripts/dm-poll-once.sh`: ```bash THREAD_ID="$1" STATUS_FILE="$2" MAX_TIMEOUT="${3:-60}" if [ -z "$THREAD_ID" ] || [ -z "$STATUS_FILE" ]; then echo "DM_POLL_ERROR:参数错误" exit 3 fi INTERVALS=(5 10 20 40 60) interval_idx=0 total_seconds=0 max_seconds=$((MAX_TIMEOUT * 60)) ``` `scripts/dm-poll.sh`: ```bash THREAD_ID="$1" STATUS_FILE="$2" MAX_TIMEOUT="${3:-60}" # 默认 60 分钟 if [ -z "$THREAD_ID" ] || [ -z "$STATUS_FILE" ]; then echo "用法: $0 [max_timeout_minutes]" exit 1 fi # 轮询间隔（秒）：递增策略 INTERVALS=(5 10 20 40 60) interval_index=0 total_seconds=0 max_seconds=$((MAX_TIMEOUT * 60)) ``` ### Technical Analysis All three scripts accept the maximum timeout as an externally supplied positional argument and place it directly into a Bash arithmetic expression without validating that it is a decimal integer. Bash arithmetic evaluation is not equivalent to parsing a simple integer. Expressions can contain variable references and array subscripts, and evaluation of crafted array-subscript expressions can result in command substitution. Consequently, quoting the value when it is assigned to `MAX_TIMEOUT` does not make its later arithmetic evaluation safe. This issue is reachable before polling begins and does not depend on a malicious DeepMiner response. ### Attack Path 1. An attacker gains control over, or persuades an ...[truncated 1417 chars]- Remediation
View remediation
&2 exit 3 fi if (( 10#$MAX_TIMEOUT < 1 || 10#$MAX_TIMEOUT > 1440 )); then echo "Error: max_timeout_minutes must be between 1 and 1440" >&2 exit 3 fi max_seconds=$((10#$MAX_TIMEOUT * 60)) ``` Apply the same validation to all three polling scripts. Additional hardening should include: - Validate every positional argument according to a strict allowlist. - Use `printf '%s\n'` rather than `echo` for externally derived values. - Add automated tests that reject whitespace, signs, variable names, array syntax, command substitutions, and excessively large numbers. - Consider implementing timeout parsing in a language with strict numeric conversion if the scripts grow more complex. ]]>