T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/dca.sh:172
- Finding
- Arbitrary Python Code Execution Through Unsanitized DCA Plan Arguments## Vulnerability Details **File Location**: `scripts/dca.sh:172-209` **Vulnerability Type**: Python source-code injection **Risk Level**: High ### Vulnerable Code ```bash action_plan() { local amount="${1:-50}" frequency="${2:-7}" periods="${3:-12}" symbol="${4:-BTCUSDT}" symbol=$(echo "$symbol" | tr '[:lower:]' '[:upper:]') # Get current price local price_resp price price_resp=$(api_public "/api/v3/ticker/price" "symbol=${symbol}") price=$(echo "$price_resp" | grep -o '"price":"[^"]*"' | head -1 | cut -d'"' -f4) echo "DCA Plan: ${symbol}" echo "==========================" echo "Buy amount: \$${amount} per buy" echo "Frequency: every ${frequency} days" echo "Duration: ${periods} buys" echo "Current: ${price}" echo "==========================" python3 -c " amount = float('${amount}') periods = int('${periods}') freq = int('${frequency}') price = float('${price}') total_invested = amount * periods btc_at_current = total_invested / price total_days = freq * periods print(f'Total invest: \${total_invested:,.2f}') print(f'At cur. price: {btc_at_current:.8f} ${symbol%%USDT*}') print(f'Time span: {total_days} days (~{total_days/30:.1f} months)') print() print('Scenario Analysis (if avg price over period is):') for pct in [-30, -20, -10, 0, 10, 20, 50, 100]: avg = price * (1 + pct/100) coins = total_invested / avg value = coins * price * (1 + pct/100) pnl = value - total_invested pnl_pct = (pnl / total_invested) * 100 sign = '+' if pnl >= 0 else '' print(f' {pct:+4d}% -> avg \${avg:>10,.2f} -> {coins:.8f} BTC -> PnL: {sign}\${pnl:>10,.2f} ({sign}{pnl_pct:.1f}%)') " 2>/dev/null || die "Python3 required for plan calculations" } ``` ### Technical Analysis The `amount`, `frequency`, and `periods` command-line arguments are interpolated directly into a string passed to `python3 -c`. The `plan` action does n ...[truncated 2643 chars]
- Remediation
- ## Remediation Suggestions Do not construct Python source code using command-line values. Pass data as positional arguments to a fixed Python program and parse it through `sys.argv`. A safer pattern is: ```bash [[ "$amount" =~ ^[0-9]+([.][0-9]+)?$ ]] || die "Amount must be a positive number" [[ "$frequency" =~ ^[1-9][0-9]*$ ]] || die "Frequency must be a positive integer" [[ "$periods" =~ ^[1-9][0-9]*$ ]] || die "Number of buys must be a positive integer" [[ "$symbol" =~ ^[A-Z0-9]{2,20}$ ]] || die "Invalid trading symbol" python3 - "$amount" "$frequency" "$periods" "$price" "$symbol" <<'PY' import sys amount = float(sys.argv[1]) frequency = int(sys.argv[2]) periods = int(sys.argv[3]) price = float(sys.argv[4]) symbol = sys.argv[5] # Perform calculations using parsed values. PY ``` Apply both syntactic validation and business limits. Recommended controls include: - Require `amount` to be a finite positive decimal and impose a reasonable maximum. - Require `frequency` and `periods` to be positive integers with upper bounds. - Restrict trading symbols to expected uppercase ASCII letters and digits. - Validate the API-provided price as a finite positive decimal before calculation. - Keep executable Python code static; never interpolate shell variables into Python source. - Run the Skill under a dedicated, unprivileged account. - Provide the Binance key only to processes that require it. - Configure the Binance key without withdrawal privileges, with only required spot-trading permissions and an IP allowlist. - Add regression tests containing quotes, semicolons, comment characters, newlines, and Python expressions in every CLI argument.