T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rental-dispute.sh:55- Finding
Arbitrary Python Code Execution Through Unsafe Input Path Interpolation
- Content
View full analysis
/dev/null || die "E-JSON-PARSE: Failed to read key '$key' from '$file'" } ``` The same unsafe construction is used in `json_keys()` and `json_len()`. Additional inline `python3 -c` blocks interpolate the `--input` path directly into Python source when generating evidence and timeline output. ### Technical Analysis The value supplied through `--input` is assigned to the shell variable `input` and later passed as the `file` argument to `json_get`, `json_keys`, and `json_len`. The script embeds that value directly inside a single-quoted Python string: ```python with open('$file') as f: ``` Shell quoting does not make this safe because the interpolation occurs while constructing Python source code. If the filename contains a single quote followed by a valid Python expression, the filename can terminate or alter the intended Python string and introduce executable Python syntax. The `require_input()` function only checks that the supplied path refers to an existing regular file: ```bash [ -f "$input" ] || die "E-FILE-NOT-FOUND: Input file '$input' not found." ``` This existence check does not sanitize the filename and does not prevent source-code injection. Unix filenames can contain quotes, spaces, semicolons, and most other char ...[truncated 2470 chars]- Remediation
View remediation