T09 · Insecure Skill Coding Practices
Error
- Location
deliverer/telegram.ts:120- Finding
Shell Command Injection and Telegram Credential Exposure
- Content
View full analysis
{ if (!this.botToken || !this.chatId) { throw new Error('Bot token or chat ID not configured'); } // 截断消息（Telegram消息长度限制4096字符） const maxLength = 4000; const truncated = text.length > maxLength ? text.substring(0, maxLength) + '...' : text; // 使用curl发送消息 const curlCommand = `curl -s -X POST "https://api.telegram.org/bot${this.botToken}/sendMessage" \\ -d "chat_id=${this.chatId}" \\ -d "text=${encodeURIComponent(truncated)}" \\ -d "parse_mode=Markdown" \\ -d "disable_web_page_preview=false"`; return new Promise((resolve, reject) => { exec(curlCommand, (error, stdout, stderr) => { if (error) { console.error(`[Telegram] curl error: ${error.message}`); console.error(`[Telegram] stderr: ${stderr}`); reject(error); return; } const response = JSON.parse(stdout); if (!response.ok) { throw new Error(`Telegram API error: ${response.description}`); } resolve(); }); }); } ``` ### Technical Analysis The Telegram bot token and chat ID are directly interpolated into a command string passed to Node.js `child_process.exec()`. The `exec()` API invokes a system shell, so shell metacharacters and command substitutions embedded in either configuration value are interpreted by that shell. Although the report text is passed through `encodeURIComponent()`, neither `this.botToken` nor `this.chatId` is validated, encoded, or safely supplied as a separate process argument. Double quotes do not prevent shell command substitution such as `$()` on common Unix shells. Consequently, a malicious configuration value can escape or exploit the command context and execute a ...[truncated 2282 chars]- Remediation
View remediation