T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/download.sh:93
- Finding
- Unquoted Proxy Argument Expansion Enables yt-dlp Option Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download.sh:93-97`, with vulnerable expansions at `scripts/download.sh:109-116` and `scripts/download.sh:146-153` **Vulnerability Type**: Command-line option injection through unsafe shell argument construction **Risk Level**: High ### Vulnerable Code ```bash # Build proxy args PROXY_ARGS="" if [[ -n "$PROXY" ]]; then echo "🌐 Proxy: $PROXY" PROXY_ARGS="--proxy $PROXY" fi ``` The resulting scalar is expanded without quoting in audio-download mode: ```bash if ! yt-dlp \ --extract-audio \ --audio-format mp3 \ --audio-quality 0 \ --output "$AUDIO_DIR/%(title)s_%(id)s.%(ext)s" \ --no-warnings \ --progress \ $PROXY_ARGS \ "$URL" 2>&1; then ``` The same unsafe expansion occurs in video-download mode: ```bash if ! yt-dlp \ --format "$FORMAT" \ --merge-output-format mp4 \ --output "$OUTPUT_DIR/%(title)s_%(id)s.%(ext)s" \ --no-warnings \ --progress \ $PROXY_ARGS \ "$URL" 2>&1; then ``` ### Technical Analysis The proxy value is user-controlled and is concatenated into the scalar variable `PROXY_ARGS`. Expanding `$PROXY_ARGS` without quotes causes Bash to perform word splitting and pathname expansion. Consequently, whitespace inside the supplied proxy value can produce additional command-line arguments. Those additional arguments are passed directly to `yt-dlp` and interpreted as options rather than as part of the proxy address. This does not create direct shell metacharacter evaluation because the shell does not parse operators introduced by parameter expansion as new shell syntax. However, it creates an option-injection vulnerability. This is security-sensitive because `yt-dlp` exposes options that can invoke external commands, including execution hooks. An attacker can inject such an option and cause attacker-selected local behavior when the download is processed. ### Attack Path 1. An attacker gains control over, or persuades a user or automation process to use, ...[truncated 1699 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Store command arguments in a Bash array so that every logical argument remains a single argument: ```bash PROXY_ARGS=() if [[ -n "$PROXY" ]]; then echo "🌐 Proxy: configured" PROXY_ARGS=(--proxy "$PROXY") fi ``` Expand the array safely at both call sites: ```bash yt-dlp \ --extract-audio \ --audio-format mp3 \ --audio-quality 0 \ --output "$AUDIO_DIR/%(title)s_%(id)s.%(ext)s" \ --no-warnings \ --progress \ "${PROXY_ARGS[@]}" \ "$URL" ``` Apply the same change to video-download mode. Additional hardening should include: 1. Validate proxy URLs against an allowlist of supported schemes, such as `http`, `https`, `socks4`, `socks5`, and `socks5h`. 2. Reject proxy values containing control characters, line breaks, or invalid URL components. 3. Ensure required option values exist before reading `$2`. 4. Avoid logging proxy credentials because proxy URLs may contain usernames or passwords. 5. Add regression tests confirming that spaces and strings resembling `yt-dlp` options remain part of one proxy argument or are rejected. ]]>