T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/x-search.sh:36
- Finding
- User-Controlled JavaScript Injection in an Authenticated Browser Context<![CDATA[ ## Vulnerability Details **File Location**: `scripts/x-search.sh`, lines 10-14, 36-38, and 87 **Vulnerability Type**: JavaScript injection through unsafe interpolation of command-line arguments **Risk Level**: High ### Vulnerable Code ```bash # Parameters TOPIC="${1:-Claude Code}" MAX_RESULTS="${2:-5}" SCROLL_TIMES="${3:-3}" MIN_LIKES="${4:-0}" OUTPUT_FORMAT="${5:-markdown}" ``` The values are subsequently concatenated directly into executable JavaScript: ```bash RESULT=$(bb-browser eval ' (function() { const maxResults = '"$MAX_RESULTS"'; const minLikes = '"$MIN_LIKES"'; ``` The topic is also inserted into a JavaScript string without safe serialization: ```javascript return JSON.stringify({ topic: "'"$TOPIC"'", totalFound: results.length, returned: Math.min(maxResults, results.length), posts: results.slice(0, maxResults) }, null, 2); ``` ### Technical Analysis The script accepts `TOPIC`, `MAX_RESULTS`, and `MIN_LIKES` as untrusted command-line arguments. These values are inserted into the source code passed to `bb-browser eval` without strict type validation or JavaScript-safe encoding. `MAX_RESULTS` and `MIN_LIKES` are placed directly in JavaScript expression positions: ```javascript const maxResults = USER_CONTROLLED_VALUE; const minLikes = USER_CONTROLLED_VALUE; ``` An attacker can supply a value containing JavaScript statement delimiters and additional expressions. For example, a numeric argument conceptually shaped as: ```text 1; ATTACKER_CONTROLLED_JAVASCRIPT; const placeholder = 1 ``` can terminate the intended assignment and introduce additional statements while preserving syntactically valid code. `TOPIC` is inserted between double quotes in a JavaScript object literal. Quotes, backslashes, line terminators, and other JavaScript metacharacters are not escaped. A specially crafted topic can therefore terminate the string and alter the surrounding object literal or execute an expression. This is more seve ...[truncated 1956 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Never concatenate untrusted input into executable JavaScript.** Keep the evaluated JavaScript fixed and pass values through a structured argument mechanism supported by the browser automation tool. 2. **Serialize text using a trusted JSON encoder.** For example, encode the topic with `jq` before exposing it to JavaScript: ```bash TOPIC_JSON=$(jq -Rn --arg value "$TOPIC" '$value') ``` The resulting JSON string must be treated as data rather than inserted into a quoted JavaScript string. 3. **Strictly validate numeric arguments.** Require unsigned decimal integers and reject all other input: ```bash case "$MAX_RESULTS" in ''|*[!0-9]*) echo "Invalid maxResults" >&2; exit 1 ;; esac case "$MIN_LIKES" in ''|*[!0-9]*) echo "Invalid minLikes" >&2; exit 1 ;; esac case "$SCROLL_TIMES" in ''|*[!0-9]*) echo "Invalid scrollTimes" >&2; exit 1 ;; esac ``` 4. **Enforce reasonable bounds** to prevent excessive browser activity or resource consumption, such as: - `MAX_RESULTS`: 1–100 - `MIN_LIKES`: 0–1,000,000,000 - `SCROLL_TIMES`: 0–20 5. **Prefer structured browser-evaluation arguments.** If `bb-browser` supports passing JSON arguments separately from source code, use that facility. The evaluated program should retrieve values from the structured argument object rather than from generated source. 6. **Add security regression tests** covering topics and arguments containing: - Single and double quotes - Backslashes - Newlines and Unicode line separators - Semicolons and parentheses - Template-literal characters - JavaScript comments - Non-numeric values and values outside permitted bounds 7. **Use proper URL encoding** for the search topic rather than replacing only spaces. A standard percent-encoder prevents the topic from changing query parameters or URL structure. ]]>