T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export-x-cookies.sh:29- Finding
Python Code Injection Through FOXX_COOKIES_OUT
- Content
View full analysis
/dev/null && sleep 2 || true cp "$DB" "$TMP_DB" python3 - << EOF import sqlite3, json conn = sqlite3.connect("$TMP_DB") rows = conn.execute(""" SELECT host, name, value, path, expiry, isSecure, isHttpOnly, sameSite FROM moz_cookies WHERE host LIKE '%twitter%' OR host LIKE '%x.com%' """).fetchall() cookies = [] for r in rows: exp = r[4] if exp > 1e10: exp = int(exp / 1000) elif exp < -1: exp = -1 cookies.append({ "domain": r[0], "name": r[1], "value": r[2], "path": r[3], "expires": exp, "secure": bool(r[5]), "httpOnly": bool(r[6]), "sameSite": ["None","Lax","Strict"][r[7]] if r[7] < 3 else "None" }) conn.close() with open("$OUT", "w") as f: json.dump({"cookies": cookies}, f, indent=2) print(f"✅ Exported {len(cookies)} cookies -> $OUT") EOF ``` ### Technical Analysis The heredoc delimiter is not quoted, so the shell expands variables throughout the generated Python program. `FOXX_COOKIES_OUT` controls `OUT`, which is inserted directly inside a Python string literal: ```python with open("$OUT", "w") as f: ``` A value containing quotation marks and newline characters can terminate the intended string and introduce additional Python statements. The value is therefore treated as executable Python syntax rather than exclusively as file-path data. The shell quoting applied when assigning and using `OUT` for `mkdir` does not protect its later interpolation into the heredoc. ### Attack Path 1. An attacker gains control over `FOXX_COOKIES_OUT`, such as through a wrapper scr ...[truncated 934 chars]- Remediation
View remediation