T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/search_token.sh:29
- Finding
- Arbitrary Python Code Execution Through Shell-Expanded Heredoc<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_token.sh:29-34` **Vulnerability Type**: Injection of user-controlled shell arguments into executable Python source **Risk Level**: High ### Vulnerable Code ```bash python3 << PYTHON import json import sys token = "${TOKEN}".upper() data_file = "${DATA_FILE}" ``` The values assigned to `TOKEN` and `DATA_FILE` originate from the user-controlled `--token` and `--data` command-line arguments: ```bash while [[ $# -gt 0 ]]; do case $1 in --token) TOKEN="$2"; shift 2 ;; --data) DATA_FILE="$2"; shift 2 ;; *) shift ;; esac done ``` ### Technical Analysis The heredoc delimiter is unquoted, so the shell performs parameter expansion before passing the generated source to Python. The expanded values are placed directly inside Python string literals without escaping. An argument containing a quote, newline, or valid Python expression can terminate the intended string literal and inject additional Python statements. This is not merely malformed input: the resulting content is interpreted as executable Python source. The local token-search functionality only needs to pass two data values to Python. Generating Python source from those values is unnecessary and violates the principle of treating external input as data rather than code. ### Attack Path 1. An attacker causes the Skill or a user to invoke `search_token.sh` with a crafted `--token` or `--data` argument. 2. The argument is stored in `TOKEN` or `DATA_FILE`. 3. The unquoted heredoc expands the malicious value directly into the Python program. 4. The crafted value escapes the surrounding Python string. 5. Python executes the injected statements with the privileges of the process running the Skill. A conceptual malicious value could terminate the string, invoke functionality such as `os.system(...)`, and comment out the remaining generated source. ### Impact Assessment Successful exploitation provides arbi ...[truncated 531 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Pass user-controlled values as arguments rather than embedding them in generated source. Quote the heredoc delimiter to disable shell expansion: ```bash python3 - "$TOKEN" "$DATA_FILE" <<'PYTHON' import json import sys token = sys.argv[1].upper() data_file = sys.argv[2] with open(data_file, encoding="utf-8") as f: data = json.load(f) # Continue processing data. PYTHON ``` Additional hardening should include: 1. Validate `TOKEN` against an expected format, such as a conservative alphanumeric token-symbol pattern. 2. Restrict `DATA_FILE` to an approved directory when arbitrary file selection is not required. 3. Reject unexpected command-line arguments instead of silently ignoring them. 4. Add regression tests containing quotes, newlines, command substitutions, and Python syntax. ]]>