T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/risk-check.sh:125- Finding
Remote API Data Is Interpolated Directly into AWK Programs
- Content
View full analysis
0)}"; then ratio=$(awk "BEGIN {printf \"%.4f\", $market_cap / $fdv}") if awk "BEGIN {exit !($ratio >= 0.8)}"; then score=$((score + 20)) elif awk "BEGIN {exit !($ratio >= 0.5)}"; then score=$((score + 10)) elif awk "BEGIN {exit !($ratio >= 0.2)}"; then score=$((score + 0)) else score=$((score - 15)) fi fi # Liquidity vs Market Cap (20 pts) if [[ -n "$liquidity_usd" && "$liquidity_usd" != "null" && -n "$market_cap" && "$market_cap" != "null" ]] && awk "BEGIN {exit !($market_cap > 0)}"; then local liq_ratio=$(awk "BEGIN {printf \"%.4f\", $liquidity_usd / $market_cap}") if awk "BEGIN {exit !($liq_ratio >= 0.1)}"; then score=$((score + 20)) elif awk "BEGIN {exit !($liq_ratio >= 0.05)}"; then score=$((score + 10)) elif awk "BEGIN {exit !($liq_ratio >= 0.01)}"; then score=$((score + 0)) else score=$((score - 20)) fi fi # 24h Volume / Liquidity ratio (10 pts) if [[ -n "$h24_vol" && "$h24_vol" != "null" && -n "$liquidity_usd" && "$liquidity_usd" != "null" ]] && awk "BEGIN {exit !($liquidity_usd > 0)}"; then local vol_ratio=$(awk "BEGIN {printf \"%.4f\", $h24_vol / $liquidity_usd}") if awk "BEGIN {exit !($vol_ratio >= 0.05)}"; then score=$((score + 10)) elif awk "BEGIN {exit !($vol_ratio >= 0.01)}"; then score=$((score + 5)) fi fi # FDV check if [[ -n "$fdv" && "$fdv" != "null" ]]; then if awk "BEGIN {exit !($fdv < 10000000)}"; then score=$((score - 5)) fi if awk "BEGIN {exit !($fdv > 10000000000)}"; then score=$((score + 5)) fi fi ``` The same unsafe construction is repeated during report generation: ```b ...[truncated 4085 chars]- Remediation
View remediation
0) }' ``` For calculations: ```bash ratio=$(awk -v market_cap="$market_cap" -v fdv="$fdv" \ 'BEGIN { printf "%.4f", market_cap / fdv }') ``` 2. **Enforce JSON types with `jq`.** Reject fields that are not numbers: ```bash FDV=$(jq -er ' .pairs | sort_by(.liquidity.usd // 0) | reverse | .[0].fdv | select(type == "number") ' <<<"$DEX_DATA") || { echo "Invalid FDV returned by API" >&2 exit 1 } ``` 3. **Apply strict numeric validation before arithmetic.** Support only the formats actually required by the APIs: ```bash is_number() { [[ "$1" =~ ^-?[0-9]+([.][0-9]+)?([eE][+-]?[0-9]+)?$ ]] } is_number "$MARKET_CAP" || { echo "Invalid market-cap value" >&2 exit 1 } ``` 4. **Apply the same fix to every API-derived numeric value**, including: - `TVL_SUM` - `STAKE_TVL` - `POOL2_TVL` - `MARKET_CAP` - `LIQUIDITY_USD` - `H24_VOL` - `FDV` - Calculated ratio values 5. **Fail closed on malformed API responses.** Do not assign a risk score from data that fails schema or type validation. 6. **Harden network error handling.** Use options such as `--fail`, `--show-error`, response-size limits where practical, and explicit JSON validation before processing: ```bash DEX_DATA=$(curl --fail --silent --show-error --max-time 10 \ "https://api.dexscreener.com/latest/dex/tokens/$TARGET") || exit 1 ``` 7. **Remove the unused `eval` helper at lines 35-41.** It has no current call site, but retaining an `eval`-based utility creates an avoidable future command-injection hazard. ]]>