T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:31- Finding
Shell Command Injection Through Generated Configuration File
- Content
View full analysis
"$config_file" << EOF PRIVATE_PATH="$private_path" PUBLIC_PATH="$public_path" EOF ``` The generated file is subsequently executed as shell code: ```bash if [ -f "$CONFIG_FILE" ]; then source "$CONFIG_FILE" else ``` ### Technical Analysis The setup script accepts arbitrary path values and writes them directly into `config.sh` as shell assignment statements. The values are not escaped for use in shell source code. Because `sync.sh` loads the resulting file with `source`, shell metacharacters embedded in a configured path are interpreted as executable shell syntax. For example, an input containing command substitution such as `$(command)` is written inside the double-quoted assignment and is executed when `config.sh` is sourced. This crosses a trust boundary: data supplied as a filesystem path is converted into executable shell code. The use of double quotes around the generated value does not prevent command substitution, backtick substitution, or syntax injection through embedded quotes. ### Attack Path 1. An attacker convinces a user to enter a crafted private or public repository path during setup, or otherwise controls the setup input. 2. The crafted value contains shell syntax, such as command substitution or an ...[truncated 1184 chars]- Remediation
View remediation
"$config_file" ``` 4. Validate that each supplied value is an acceptable absolute or home-relative path before saving it. 5. Reject control characters and unexpected newlines. 6. Create the configuration with restrictive permissions: ```bash umask 077 ``` 7. Prefer parsing explicitly delimited key/value records over executing the entire configuration file. 8. Document that the configuration file is security-sensitive and must not be writable by untrusted users. ]]>