T09 · Insecure Skill Coding Practices
Error
- Location
references/config-center-template.md:10- Finding
Unvalidated Template Interpolation Enables Kotlin Source-Code Injection
- Content
View full analysis
query{Name}Config(@Body {Name}Request request); } ``` `references/config-center-template.md:10-13`: ```kotlin private const val CONFIG_KEY_CONFIG_VERSION = "1.0.0" private const val CONFIG_KEY_YZ_HD_{NAME}_CONFIG = "{componentKey}" private const val TAG = "{Name}ConfigManager" private const val CONFIG_KEY_YZ_HD_{NAME}_CONFIG_KEY = "{fieldKey}" ``` `references/push-pull-template.md:10-11`: ```kotlin private const val PUSH_KEY = "{pushKey}" private const val PULL_URL = "{pullUrl}" ``` `references/whitelist-template.md:9`: ```kotlin WhiteListTask.isInWhiteList({key}).subscribe({ result -> // TODO 待实现 }, { error -> // TODO 待实现 }) ``` ### Technical Analysis The placeholders include configuration names, JSON-derived field names, API URLs, component keys, field keys, push keys, pull URLs, and whitelist keys. These values can enter either: 1. **Kotlin string-literal contexts**, such as `"{componentKey}"` and `"{pullUrl}"`; or 2. **Kotlin identifier contexts**, such as `{Name}`, `{NAME}`, method names, class names, and generated JSON property names. No instruction requires escaping Kotlin string literals, rejecting line breaks or control characters, validating identifiers ...[truncated 2393 chars]- Remediation
View remediation