T09 · Insecure Skill Coding Practices
Error
- Location
platform-helper.py:94- Finding
Shell Command Injection in Generated Download Commands
- Content
View full analysis
dict: """ 生成安全的下载指导 注意：不执行下载，仅提供指导 """ if not output_name: output_name = "video_download" # 验证 URL 安全性 parsed = urllib.parse.urlparse(video_url) if parsed.scheme not in ["http", "https"]: return { "status": "error", "message": "仅支持 HTTP/HTTPS 协议" } # 提供安全的下载方法 result = { "status": "guide_generated", "video_url": video_url, "suggested_name": f"{output_name}.mp4", "methods": { "browser": { "description": "浏览器直接下载（推荐）", "steps": [ f"1. 在浏览器中打开: {video_url}", "2. 按 Ctrl+S 或右键 → 另存为", f"3. 保存为: {output_name}.mp4" ] }, "curl": { "description": "使用 curl 下载（命令行）", "command": f'curl -L -o "{output_name}.mp4" "{video_url}"', "note": "在终端中运行此命令" }, "wget": { "description": "使用 wget 下载（命令行）", "command": f'wget -O "{output_name}.mp4" "{video_url}"', ``` ### Technical Analysis The `video_url` and `output_name` values originate from command-line arguments and are interpolated directly into commands intended to be run in a shell. Neither value is safely quoted or constrained by a strict allowlist. The URL validation only verifies that `urllib.parse.urlparse(video_url).scheme` is either `http` or `https`. This does not reject embedded quotation marks, command separators, command substitutions, shell metacharacters, or newline characters. No validation is applied to `output_name`. Wrapp ...[truncated 2166 chars]- Remediation
View remediation