T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/acestep-lyrics-transcription.sh:147
- Finding
- Arbitrary Python Code Execution Through Crafted Output Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/acestep-lyrics-transcription.sh:147-197` and `scripts/acestep-lyrics-transcription.sh:210-258` **Vulnerability Type**: Python source injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code The LRC conversion function directly embeds the output path into Python source: ```bash words_to_lrc() { local json_file="$(to_python_path "$1")" local output_file="$(to_python_path "$2")" local line_gap="${3:-1.5}" find_python $PYTHON_CMD -c " import json, sys, unicodedata # ... with open('$json_file', 'r', encoding='utf-8') as f: words = json.load(f) # ... with open('$output_file', 'w', encoding='utf-8') as f: for line in lines: f.write(line + '\n') " } ``` The SRT conversion function repeats the same pattern: ```bash words_to_srt() { local json_file="$(to_python_path "$1")" local output_file="$(to_python_path "$2")" local line_gap="${3:-1.5}" find_python $PYTHON_CMD -c " import json, sys # ... with open('$json_file', 'r', encoding='utf-8') as f: words = json.load(f) # ... with open('$output_file', 'w', encoding='utf-8') as f: for idx, (s, e, text) in enumerate(lines, 1): f.write(f'{idx}\n') f.write(f'{fmt(s)} --> {fmt(e)}\n') f.write(f'{text}\n') f.write('\n') " } ``` The value originates from the user-controlled `--output` argument: ```bash --output|-o) output="$2"; shift 2 ;; ``` It is subsequently passed to the vulnerable conversion function: ```bash case "$format" in lrc) words_to_lrc "$words_file" "$output" ;; srt) words_to_srt "$words_file" "$output" ;; json) cp "$words_file" "$output" ;; esac ``` ### Technical Analysis Shell quoting protects the output path while it is handled by Bash, but it does not make the value safe when it is inserted into dynamically constructed Python source code. A path containin ...[truncated 1831 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not interpolate paths or numeric values into Python source. Pass all data as command-line arguments: ```bash "$PYTHON_CMD" -c ' import json import sys json_file = sys.argv[1] output_file = sys.argv[2] line_gap = float(sys.argv[3]) with open(json_file, "r", encoding="utf-8") as f: words = json.load(f) # Conversion logic... with open(output_file, "w", encoding="utf-8") as f: # Write converted data... pass ' "$json_file" "$output_file" "$line_gap" ``` Additional hardening should include: 1. Validate `line_gap` as a numeric value before passing it to Python. 2. Normalize and validate output paths according to the intended write policy. 3. Use a standalone Python file rather than a dynamically generated `python -c` program. 4. Add tests using paths containing single quotes, double quotes, newlines, backslashes, Unicode characters, and shell/Python metacharacters. 5. Run the conversion component with only the filesystem permissions necessary to create the requested output. ]]>