T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/export-x-cookies.sh:29
- Finding
- Python Code Injection Through FOXX_COOKIES_OUT<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export-x-cookies.sh`, lines 29-62 **Vulnerability Type**: Environment-variable injection into an unquoted heredoc **Risk Level**: High ### Vulnerable Code ```bash OUT="${FOXX_COOKIES_OUT:-$(dirname "$0")/../secrets/x-cookies.json}" mkdir -p "$(dirname "$OUT")" echo "🦊 Ganidhuz-FoxX: Exporting X cookies from $PROFILE_PATH" pkill -f firefox 2>/dev/null && sleep 2 || true cp "$DB" "$TMP_DB" python3 - << EOF import sqlite3, json conn = sqlite3.connect("$TMP_DB") rows = conn.execute(""" SELECT host, name, value, path, expiry, isSecure, isHttpOnly, sameSite FROM moz_cookies WHERE host LIKE '%twitter%' OR host LIKE '%x.com%' """).fetchall() cookies = [] for r in rows: exp = r[4] if exp > 1e10: exp = int(exp / 1000) elif exp < -1: exp = -1 cookies.append({ "domain": r[0], "name": r[1], "value": r[2], "path": r[3], "expires": exp, "secure": bool(r[5]), "httpOnly": bool(r[6]), "sameSite": ["None","Lax","Strict"][r[7]] if r[7] < 3 else "None" }) conn.close() with open("$OUT", "w") as f: json.dump({"cookies": cookies}, f, indent=2) print(f"✅ Exported {len(cookies)} cookies -> $OUT") EOF ``` ### Technical Analysis The heredoc delimiter is not quoted, so the shell expands variables throughout the generated Python program. `FOXX_COOKIES_OUT` controls `OUT`, which is inserted directly inside a Python string literal: ```python with open("$OUT", "w") as f: ``` A value containing quotation marks and newline characters can terminate the intended string and introduce additional Python statements. The value is therefore treated as executable Python syntax rather than exclusively as file-path data. The shell quoting applied when assigning and using `OUT` for `mkdir` does not protect its later interpolation into the heredoc. ### Attack Path 1. An attacker gains control over `FOXX_COOKIES_OUT`, such as through a wrapper scr ...[truncated 934 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Quote the heredoc delimiter so that shell expansion is disabled: ```bash python3 - "$TMP_DB" "$OUT" <<'PY' import json import sqlite3 import sys tmp_db = sys.argv[1] output_path = sys.argv[2] conn = sqlite3.connect(tmp_db) # Process cookies here. with open(output_path, "w", encoding="utf-8") as output: json.dump({"cookies": cookies}, output, indent=2) PY ``` - Pass paths through command-line arguments or environment variables and read them as data inside Python. - Never interpolate environment-controlled values into generated source code. - Validate and canonicalize the output path before use. - Add regression tests using paths containing quotes, newlines, backslashes, and shell metacharacters. ]]>