T09 · Insecure Skill Coding Practices
Error
- Location
steps/01-init.md:62- Finding
Shell Command Injection Through Unsanitized Problem Identifiers and Paths
- Content
View full analysis
/dev/null cp -r question $BASE_DIR/work_{PID} # {WORK_DIR} = $BASE_DIR/work_{PID} ``` ```bash BASE_DIR=$(detect_desktop) rm -rf $BASE_DIR/work 2>/dev/null cp -r question $BASE_DIR/work # {WORK_DIR} = $BASE_DIR/work ``` `steps/02-get-info.md:45-48`: ```bash BASE_DIR=$(detect_desktop) mv $BASE_DIR/work $BASE_DIR/work_{PID} # {WORK_DIR} = $BASE_DIR/work_{PID} ``` `steps/04-problem.md:85-100`: ```bash mv {WORK_DIR} {WORK_DIR}_{title_short} # {WORK_DIR} = {WORK_DIR}_{title_short} ``` ```bash BASE_DIR=$(detect_desktop) mv $BASE_DIR/work $BASE_DIR/work_{title_short} # {WORK_DIR} = $BASE_DIR/work_{title_short} ``` `steps/07-testdata.md:167-170, 202-212`: ```bash cd {WORK_DIR} g++ std.cpp -o std -std=c++17 g++ mkdata.cpp -o mkdata -std=c++17 ./mkdata ``` ```bash rm -f {WORK_DIR}/std {WORK_DIR}/mkdata {WORK_DIR}/*.exe zip -r {pid}_{title}.zip {WORK_DIR} ``` ```bash cd {WORK_DIR}/testdata zip testdata.zip *.in *.out config.yaml ``` `steps/contest/03-move.md:35-49, 81-106, 127-149`: ```bash BASE_DIR=$(detect_desktop) rm -rf $BASE_DIR/work_{PID} cp -r question $BASE_DIR/work_{PID} # {WORK_DIR} = $BASE_DIR/work_{PID} ``` ```bash mv {WORK_DIR} {WORK_DIR}_{title_short} # {WORK_DIR} = work_{PID}_{title_short} ``` ```bash cd {WORK_DIR} g++ std.cpp -o std -std=c++17 ``` ```bash cd {WORK_DIR} g++ -o mkdata mkdata.cpp -std=c++17 ./mkdata ``` ```bash rm -f {WORK_DIR}/std {WORK_DIR}/mkdata {WORK_DIR}/*.exe {WORK_DIR}/*.zip ``` ```bash BASE_DIR=$(detect_desktop) cd $BASE_DIR rm -f work_*/*.zip zip -r {contest_id}.zip work_*/ ``` ### ...[truncated 2802 chars]- Remediation
View remediation