T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dev-tk.js:45- Finding
Shell Command Injection Through Attacker-Controlled Git Filenames
- Content
View full analysis
&1 || python3 -m py_compile {} 2>&1" 2>/dev/null || true'); ``` The `run` function executes this string through a shell: ```javascript function run(cmd, opts = {}) { try { const out = execSync(cmd, { encoding: 'utf8', stdio: 'pipe', ...opts }); return { ok: true, out: out.trim() }; } catch (e) { return { ok: false, out: e.stdout?.trim() || '', err: e.stderr?.trim() || e.message }; } } ``` ### Technical Analysis The command obtains filenames from `git diff` and passes them through `xargs` into a `sh -c` command. The `{}` placeholder is inserted directly into shell source without shell-safe quoting. Git permits filenames containing spaces, quotes, command substitutions, semicolons, and other shell metacharacters. Consequently, a repository can contain a changed filename that modifies the syntax of the generated shell command. Because `sh -c` interprets the resulting text as shell code, a malicious filename can cause arbitrary commands to execute. The filename is substituted three times: once in `echo`, once as an argument to `node -c`, and once as an argument to `python3 -m py_compile`. Any of these unquoted substitutions may alter shell parsing. The use of `|| true` suppresses the resulting failure status and may make exploitation less visible to the user. ### Attack Path 1. An attacker creates or modifies a Git-tracked file whose filename contains shell metacharacters and an injected command. 2. The attacker distributes the repository or submits the change for review. 3. A victim checks out the repository and runs `dev-tk review`. 4. `git diff --name-only` emits the attacker-controlled filename. 5. `xargs ...[truncated 1054 chars]- Remediation
View remediation