T09 · Insecure Skill Coding Practices
Error
- Location
scripts/oce-format.sh:43- Finding
Arbitrary Command Execution Through Formatter Filename Injection
- Content
View full analysis
/dev/null 2>&1; then RESULT="formatted"; else RESULT="needs_format"; return 1; fi else BACKUP=$(create_backup "$FILE") if eval "$writer_cmd"; then RESULT="reformatted" else cp "$BACKUP" "$FILE"; RESULT="failed"; return 1; fi fi } case "$LANG" in javascript|typescript|jsx|tsx|json|css|scss|less|markdown|html|vue|svelte) P=$(resolve_local prettier) if [ -n "$P" ]; then FORMATTER="prettier" run_check_or_write "$P --write '$FILE'" "$P --check '$FILE'" || true fi ;; python) if command -v black >/dev/null; then FORMATTER="black" run_check_or_write "black '$FILE'" "black --check '$FILE'" || true elif command -v ruff >/dev/null; then FORMATTER="ruff format" run_check_or_write "ruff format '$FILE'" "ruff format --check '$FILE'" || true fi ;; go) if command -v gofmt >/dev/null; then FORMATTER="gofmt" run_check_or_write "gofmt -w '$FILE'" "gofmt -l '$FILE' | grep -q . && exit 1; exit 0" || true fi ;; rust) if command -v rustfmt >/dev/null; then FORMATTER="rustfmt" run_check_or_write "rustfmt '$FILE'" "rustfmt --check '$FILE'" || true fi ;; php) if command -v php-cs-fixer >/dev/null; then FORMATTER="php-cs-fixer" run_check_or_write "php-cs-fixer fix '$FILE'" "php-cs-fixer fix --dry-run '$FILE'" || true fi ;; ruby) if command -v rubocop >/dev/null; then FORMATTER="rubocop" run_check_or_write "rubocop -A '$FILE'" "rubocop '$FILE'" || true fi ;; esac ``` ### Technical Analysis The formatter builds shell command strings containing the user-controlled `FILE` value and passes those string ...[truncated 2044 chars]- Remediation
View remediation
/dev/null 2>&1; then RESULT="formatted" else RESULT="needs_format" return 1 fi else BACKUP=$(create_backup "$FILE") if "$@"; then RESULT="reformatted" else cp "$BACKUP" "$FILE" RESULT="failed" return 1 fi fi } ``` 3. Invoke each formatter with separate arguments: ```bash run_formatter write "$P" --write "$FILE" run_formatter check "$P" --check "$FILE" ``` 4. Implement the gofmt check pipeline without `eval`, using explicit commands and captured output. 5. Add regression tests using filenames containing spaces, quotes, semicolons, command substitutions, newlines, and leading hyphens. 6. Use `--` before filenames where the formatter supports it to prevent option injection. ]]>