T09 · Insecure Skill Coding Practices
Warning
- Location
- bluetooth-monitor.sh:110
- Finding
- Terminal Escape Sequence Injection Through Bluetooth Device Names## Vulnerability Details **File Location**: `bluetooth-monitor.sh`, lines 110, 146, and 151 **Vulnerability Type**: Unsafe rendering of attacker-controlled terminal output **Risk Level**: Medium ### Vulnerable Code ```bash echo -e "🔗 ${GREEN}$name${NC}" ``` The same unsafe output pattern is used for paired devices: ```bash if [ -n "$connected" ]; then echo -e "🔗 ${GREEN}$name${NC} (已连接 / Connected)" # 获取电量 / Get battery level battery=$(get_battery_level "$name") show_battery_bar "$battery" "$name" else echo -e "🔗 $name (未连接 / Disconnected)" fi ``` ### Technical Analysis The `name` variable is extracted from Bluetooth device metadata returned by `blueutil`. Bluetooth device names are not inherently trusted because they can be selected by the owner of a nearby or previously paired device. The script embeds this value in an `echo -e` call. The `-e` option enables interpretation of backslash escapes. Consequently, a name containing supported escape notation can produce terminal control characters instead of being displayed literally. Depending on the terminal emulator and its configuration, terminal control sequences can: - Clear or overwrite displayed content. - Move the cursor and create misleading output. - Change terminal titles or colors. - Produce fake success, warning, or command-prompt messages. - Invoke terminal-specific OSC functionality, potentially including clipboard manipulation. This is terminal-output injection rather than shell command injection. The device name is not passed to `eval` or executed as a command. ### Attack Path 1. An attacker configures a Bluetooth device with a name containing backslash escape notation understood by `echo -e`. 2. The maliciously named device becomes visible as a connected or paired device on the target Mac. 3. The user executes `bluetooth-monitor connected` or `bluetooth-monitor paired`. 4. `blueutil` returns the att ...[truncated 769 chars]
- Remediation
- ## Remediation Suggestions Do not pass untrusted device metadata to `echo -e`. Use `printf` with a constant format string and place color codes and untrusted values in separate arguments: ```bash printf '🔗 %b%s%b\n' "$GREEN" "$name" "$NC" printf '🔗 %b%s%b (Connected)\n' "$GREEN" "$name" "$NC" printf '🔗 %s (Disconnected)\n' "$name" ``` As defense in depth, remove terminal control characters from device names before rendering them: ```bash safe_name=$(printf '%s' "$name" | LC_ALL=C tr -d '\000-\010\013\014\016-\037\177') ``` Use `safe_name` only for display. Preserve the original device name separately if it is required for exact data lookup. Apply the same safe-output rule to every value obtained from Bluetooth metadata.