T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:112- Finding
SQL Injection Through Interpolated User-Controlled Query Parameters
- Content
View full analysis
= '{start_date}' AND mr.created_at < '{end_date}' ``` The SQL is subsequently passed to `psql`: ```python def pg_query(ssh, sql): cmd = '/opt/gitlab/embedded/bin/psql ' \ '-h /var/opt/gitlab/postgresql ' \ '-d gitlabhq_production ' \ f'-c {shlex.quote(sql)} 2>&1' stdin, stdout, stderr = ssh.exec_command(cmd, timeout=60) return stdout.read().decode('utf-8', errors='replace') ``` ### Technical Analysis Values such as `username`, `keyword`, `start_date`, and `end_date` are inserted directly into SQL strings. A malicious value containing quotes and SQL operators can therefore change the structure of the resulting query. The use of `shlex.quote(sql)` only prevents the local shell from interpreting the SQL string as shell syntax. It does not provide SQL parameterization, escaping, statement restrictions, or protection against PostgreSQL injection. The documentation states that queries must be read-only, but the shown helper does not technically enforce that restriction. If the database account has write or administrative privileges, injected statements may execute with those privileges. ### Attack Path 1. An attacker supplies a crafted target username, keyword, or date value. 2. The Skill substitutes that value into one of the SQL templates. 3. For example, a username resembling `' OR 1=1 --` changes the identity lookup condition. 4. The altered S ...[truncated 849 chars]- Remediation
View remediation