T09 · Insecure Skill Coding Practices
Warning
- Location
skill.js:136- Finding
Unrestricted FFmpeg Paths and Protocols Permit Network Access and Arbitrary File Overwrite
- Content
View full analysis
600) die('--top invalid (0..600 or auto)'); runAllowed('ffmpeg', [ '-y', '-i', inFile, '-vf', `crop=in_w:in_h-${t}:0:${t}`, '-pix_fmt', 'yuv420p', out, ]); } function trim({ inFile, out, from, to }) { if (!inFile) die('--in required'); if (!out) die('--out required'); if (from == null || to == null) die('--from and --to required'); runAllowed('ffmpeg', [ '-y', '-ss', String(from), '-to', String(to), '-i', inFile, '-pix_fmt', 'yuv420p', out, ]); } ``` The related probing operation also passes the input directly to FFprobe: ```js function getVideoWH(inFile) { const res = spawnSync('ffprobe', [ '-v', 'error', '-select_streams', 'v:0', '-show_entries', 'stream=width,height', '-of', 'csv=p=0', inFile, ], { encoding: 'utf8' }); if (res.status !== 0) throw new Error('ffprobe failed'); const [w, h] = (res.stdout || '').trim().split(',').map(Number); if (!Number.isFinite(w) || !Number.isFinite(h)) throw new Error('invalid ffprobe output'); return { w, h }; } ``` ### Technical Analysis The `crop` and `trim` commands accept user-controlled `--in` and `--out` values and pass them directly to FFmpeg or FFprobe. The code does not restrict these values to local regular files, an approved working directory, or an allowed set of extensions and protocols. FFmpeg and FFprobe support multiple URL an ...[truncated 2851 chars]- Remediation
View remediation