T09 · Insecure Skill Coding Practices
Error
- Location
skill.yaml:15- Finding
Dockerfile Instruction Injection Through Unsanitized Configuration Values
- Content
View full analysis
- Remediation
View remediation
65535) { throw new TypeError('Port must be an integer between 1 and 65535'); } return value; } ``` 2. Validate image versions with a conservative allowlist appropriate for supported image tags. At minimum, reject whitespace, newlines, carriage returns, null bytes, and Dockerfile delimiter characters: ```javascript function validateVersion(version, fallback) { const value = version ?? fallback; if ( typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) ) { throw new TypeError('Invalid container image version'); } return value; } ``` 3. Validate values before constructing any template and interpolate only validated results. 4. Prefer explicit allowlists of supported runtime versions and full base-image references where practical. 5. Add tests that verify rejection of values containing `\n`, `\r`, spaces, tabs, null bytes, and injected directives such as `RUN`, `COPY`, and `ONBUILD`. 6. Run downstream container builds in isolated, least-privileged workers. Do not expose credentials or build secrets to untrusted Dockerfiles, restrict build-time network access, and inspect generated Dockerfiles before use in automated pipelines. ]]>