T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/dca.sh:165
- Finding
- Arbitrary Python Code Execution Through Unvalidated DCA Plan Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dca.sh`, lines 165-195 **Vulnerability Type**: Python source-code injection **Risk Level**: High ### Vulnerable Code ```bash python3 -c " amount = float('${amount}') periods = int('${periods}') freq = int('${frequency}') price = float('${price}') total_invested = amount * periods btc_at_current = total_invested / price total_days = freq * periods print(f'Total invest: \${total_invested:,.2f}') print(f'At cur. price: {btc_at_current:.8f} ${symbol%%USDT*}') print(f'Time span: {total_days} days (~{total_days/30:.1f} months)') print() print('Scenario Analysis (if avg price over period is):') for pct in [-30, -20, -10, 0, 10, 20, 50, 100]: avg = price * (1 + pct/100) coins = total_invested / avg value = coins * price * (1 + pct/100) pnl = value - total_invested pnl_pct = (pnl / total_invested) * 100 sign = '+' if pnl >= 0 else '' print(f' {pct:+4d}% -> avg \${avg:>10,.2f} -> {coins:.8f} BTC -> PnL: {sign}\${pnl:>10,.2f} ({sign}{pnl_pct:.1f}%)') " 2>/dev/null || die "Python3 required for plan calculations" ``` ### Technical Analysis The `amount`, `periods`, and `frequency` command-line arguments are interpolated directly into source code passed to `python3 -c`. The `plan` action does not validate these arguments before interpolation. Because each value is placed inside a single-quoted Python string literal, an attacker can supply a value containing a quote, terminate that literal, and append arbitrary Python statements. The shell constructs the resulting Python program before invoking the interpreter. For example, an argument shaped like the following demonstrates the injection primitive: ```text 1'); __import__('os').system('id'); # ``` This changes the generated statement into executable Python containing an attacker-controlled call to `os.system`. The vulnerability is not limited to shell commands; injected Python can directly read files, open network connec ...[truncated 1173 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Validate `amount`, `frequency`, and `periods` before invoking Python. Enforce positive decimal or integer formats and reasonable upper bounds. - Never construct executable Python source by interpolating command-line arguments. - Pass values as positional arguments instead: ```bash python3 - "$amount" "$periods" "$frequency" "$price" "$symbol" <<'PY' import sys amount = float(sys.argv[1]) periods = int(sys.argv[2]) freq = int(sys.argv[3]) price = float(sys.argv[4]) symbol = sys.argv[5] # Perform calculations here. PY ``` - Reject non-finite values, zero or negative amounts, zero or negative frequencies, and excessive period counts. - Treat API-derived values such as `price` as untrusted input and parse them as JSON before conversion. - Add regression tests containing quotes, semicolons, newlines, Python expressions, and shell metacharacters to confirm that they are rejected or handled only as data. ]]>