T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/capture_visible_tweet.py:11
- Finding
- AppleScript Injection Through an Unescaped URL Argument<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capture_visible_tweet.py`, lines 11-27 **Vulnerability Type**: AppleScript injection **Risk Level**: High ### Vulnerable Code ```python url = sys.argv[1] out = Path(sys.argv[2]).expanduser().resolve() out.parent.mkdir(parents=True, exist_ok=True) script = f''' tell application "Google Chrome" activate if (count of windows) = 0 then make new window tell front window set URL of active tab to "{url}" end tell delay 2 set b to bounds of front window set u to URL of active tab of front window return u & "\n" & ((item 1 of b as text) & "," & (item 2 of b as text) & "," & (item 3 of b as text) & "," & (item 4 of b as text)) end tell ''' ``` ### Technical Analysis The first command-line argument is treated as untrusted URL input and directly interpolated into executable AppleScript source. No escaping, encoding, or structural URL validation occurs before the generated script is passed to `osascript`. An attacker can supply a value containing a double quote followed by AppleScript statements. The quote can terminate the intended URL string, after which the injected statements become part of the generated script. This is a code-injection boundary rather than merely malformed URL handling. The later check of Chrome's current URL cannot mitigate this issue because the generated AppleScript has already been parsed and executed by that point. ### Attack Path 1. An attacker submits a crafted value where a tweet URL is expected. 2. The agent passes that value as the first argument to `capture_visible_tweet.py`. 3. The value is inserted into the `set URL of active tab to "..."` statement without escaping. 4. Embedded quote characters terminate the intended AppleScript string. 5. Attacker-supplied AppleScript statements are parsed and executed by `osascript`. 6. The injected code runs with the permissions of the user account executing the skill. ### Impact Assessment Successful exploita ...[truncated 498 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not interpolate the URL into AppleScript source. 2. Pass the URL as a positional argument to `osascript` and retrieve it through an `on run argv` handler: ```python script = r''' on run argv set targetURL to item 1 of argv tell application "Google Chrome" activate if (count of windows) = 0 then make new window tell front window set URL of active tab to targetURL end tell end tell end run ''' subprocess.check_call(["osascript", "-e", script, url]) ``` 3. Before invoking AppleScript, parse the URL with `urllib.parse.urlsplit`. 4. Require the `https` scheme and an exact normalized hostname allowlist such as `x.com`, `www.x.com`, `twitter.com`, and `www.twitter.com`. 5. Reject embedded credentials, unexpected ports, control characters, and URLs that do not match an expected post path. 6. Add regression tests containing quotes, newlines, backslashes, Unicode hostnames, credentials, and deceptive hostnames to verify that input can never modify the script structure. ]]>