T09 · Insecure Skill Coding Practices
Error
- Location
scripts/download.sh:93- Finding
Unquoted Proxy Argument Expansion Enables yt-dlp Option Injection
- Content
View full analysis
&1; then ``` The same unsafe expansion occurs in video-download mode: ```bash if ! yt-dlp \ --format "$FORMAT" \ --merge-output-format mp4 \ --output "$OUTPUT_DIR/%(title)s_%(id)s.%(ext)s" \ --no-warnings \ --progress \ $PROXY_ARGS \ "$URL" 2>&1; then ``` ### Technical Analysis The proxy value is user-controlled and is concatenated into the scalar variable `PROXY_ARGS`. Expanding `$PROXY_ARGS` without quotes causes Bash to perform word splitting and pathname expansion. Consequently, whitespace inside the supplied proxy value can produce additional command-line arguments. Those additional arguments are passed directly to `yt-dlp` and interpreted as options rather than as part of the proxy address. This does not create direct shell metacharacter evaluation because the shell does not parse operators introduced by parameter expansion as new shell syntax. However, it creates an option-injection vulnerability. This is security-sensitive because `yt-dlp` exposes options that can invoke external commands, including execution hooks. An attacker can inject such an option and cause attacker-selected local behavior when the download is processed. ### Attack Path 1. An attacker gains control over, or persuades a user or automation process to use, ...[truncated 1699 chars]- Remediation
View remediation