T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_dispatchi.sh:161- Finding
Shell Command Injection Through the tmux Output Pipeline
- Content
View full analysis
> '$RESULT_DIR/task-output.txt'" || true ``` ### Technical Analysis The user-controlled `PROJECT` and `TASK_NAME` arguments are embedded in `RUN_ID` and `RESULT_DIR`. The resulting path is then interpolated into the command string supplied to `tmux pipe-pane`. Although the path is surrounded by literal single quotes, neither argument is validated and embedded single-quote characters are not escaped. A single quote in either argument can terminate the intended shell quoting and append arbitrary shell syntax. `tmux pipe-pane` executes the supplied command through a shell. Consequently, this is not merely an unusual filename issue: attacker-controlled shell metacharacters become executable syntax when tmux starts the output pipeline. For example, a task name containing a value conceptually similar to: ```text x'; touch /tmp/dispatchi-pwned; # ``` can cause the generated command to contain: ```bash cat >> '/configured/result/path/...-x'; touch /tmp/dispatchi-pwned; #-interactive/task-output.txt' ``` The exact prefix depends on the configured result directory and generated timestamp, but the single quote closes the path argument, the semicolon begins a new command, and the comment marker suppresses the remaining generated text. ### Attack Path 1. An attacker obtains the ability to invoke `/dispatchi` or influence its `projec ...[truncated 1195 chars]- Remediation
View remediation
&2 exit 2 fi if [[ ! "$TASK_NAME" =~ $IDENTIFIER_RE ]]; then echo "Error: invalid task identifier" >&2 exit 2 fi ``` 2. Avoid passing user-derived values through a shell command. Prefer a logging mechanism that accepts an argument vector rather than a command string. 3. If `pipe-pane` necessarily requires shell syntax, quote the complete output path with a proven shell-escaping operation instead of manually adding single quotes: ```bash printf -v OUTPUT_Q '%q' "$RESULT_DIR/task-output.txt" tmux -S "$TMUX_SOCKET_PATH" pipe-pane -o \ -t "${TMUX_SESSION}:0.0" \ "cat >> $OUTPUT_Q" ``` Strict identifier validation should still be retained as defense in depth. 4. Add regression tests containing single quotes, semicolons, command substitutions, newlines, spaces, and comment characters. 5. Run the dispatcher under a dedicated low-privilege account with minimal filesystem and credential access to reduce the impact of any future command-injection flaw. ]]>