T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/generate_content.py:148
- Finding
- Unescaped User Input Permits Terminal Control-Sequence Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_content.py:148-154, 201-224` **Vulnerability Type**: Terminal control-sequence injection **Risk Level**: Low ### Vulnerable Code ```python def interactive_mode(): """Prompt user for all collection details.""" print("=== Crypto Content Crafter - Interactive Mode ===\n") name = input("Collection Name: ").strip() tagline = input("Tagline: ").strip() theme = input("Theme/Vibe: ").strip() ``` The collected values are subsequently included in generated content and printed without escaping: ```python print(f"CONTENT GENERATED FOR: {name}") print("="*60) print("\n>>> SHORT DESCRIPTION <<<\n") print(generate_short_description(name, tagline, supply)) print("\n>>> COLLECTION DESCRIPTION <<<\n") print(generate_collection_description(name, tagline, supply, price, theme)) print("\n>>> TWITTER THREAD <<<\n") print(generate_twitter_thread(name, tagline, supply, price, theme, twitter)) print("\n>>> DISCORD WELCOME MESSAGE <<<\n") print(generate_discord_welcome(name, theme)) print("\n>>> ROADMAP <<<\n") print(generate_roadmap(name)) print("\n>>> MINT ANNOUNCEMENT <<<\n") print(generate_mint_announcement(name, supply, price, theme)) ``` ### Technical Analysis Interactive input and command-line arguments are treated as trusted display text. Values such as the collection name, tagline, theme, and Twitter handle are interpolated into generated strings and written directly to the terminal. No validation removes ASCII control characters, ANSI escape sequences, or other non-printable characters. If an attacker controls an input value, terminal emulators may interpret embedded sequences rather than displaying them literally. Depending on terminal capabilities and configuration, this could clear or reposition output, change colors, alter the terminal title, create misleading hyperlinks, or visually conceal subsequent messages. The script itself does not execute commands from th ...[truncated 1055 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject or escape terminal control characters before including external values in terminal output. 2. Permit only expected printable Unicode characters for fields such as names, themes, and handles. 3. Explicitly remove characters in the C0 and C1 control ranges, including the escape character `\x1b`. 4. Apply validation to both interactive input and command-line arguments. 5. Keep an unmodified value only if it is needed internally; use a separately sanitized representation for terminal output. 6. Add tests covering ANSI color sequences, cursor movement, terminal hyperlinks, carriage returns, backspaces, and multiline values. For example: ```python import re CONTROL_CHARACTERS = re.compile(r"[\x00-\x1f\x7f-\x9f]") def sanitize_terminal_text(value: str) -> str: return CONTROL_CHARACTERS.sub("", value) ``` Apply the function before values are passed into generation functions or printed. If multiline content is not required, reject newline and carriage-return characters rather than silently removing them. ]]>