T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/query.mjs:145
- Finding
- Terminal Escape-Sequence Injection Through Unsanitized Output## Vulnerability Details **File Location**: `scripts/query.mjs:145-155`, with terminal output sinks at `scripts/query.mjs:177-178` and `scripts/query.mjs:193` **Vulnerability Type**: Terminal escape-sequence injection **Risk Level**: Medium ### Vulnerable Code ```js if (data.data && data.data.length > 0) { data.data.forEach((item, index) => { const time = item.time || '未知时间'; const context = item.context || '无信息'; const location = item.location ? ` [${item.location}]` : ''; output += `${index + 1}. [${time}]${location} ${context}\n`; }); } else { output += `暂无物流信息，请稍后查询。\n`; } ``` The tracking number is also emitted directly: ```js console.log(`快递单号: ${trackingNumber}`); console.log(`快递公司: ${companyInfo.name}${companyInfo.code === 'unknown' ? ' (请使用 --company 指定)' : ''}\n`); ``` The assembled output containing remote API values is subsequently printed: ```js } else { console.log(output); } ``` ### Technical Analysis The script incorporates untrusted values into terminal output without validating or neutralizing terminal control characters. The affected inputs include: - The tracking number supplied through the command line. - The `time`, `context`, and `location` fields returned by the external tracking services. - Other response-derived status text processed by the output formatter. Terminal emulators interpret ANSI, CSI, and OSC escape sequences rather than displaying them as ordinary text. Consequently, a tracking number containing control sequences, or a malicious or compromised API response, can alter how the terminal renders the program's output. This issue is terminal injection rather than shell command injection: the strings are not passed to a shell or command-execution API. The practical effects depend on the terminal emulator and its configuration. ### Attack Path 1. An attacker supplies a crafted tracking number containing terminal esc ...[truncated 1388 chars]
- Remediation
- ## Remediation Suggestions 1. Validate tracking numbers against strict carrier-specific allowlists before making requests or displaying them. Reject control characters and unexpected punctuation rather than merely removing them. 2. Sanitize every untrusted string received from command-line arguments or remote services before writing it to an interactive terminal. 3. Remove C0 and C1 control characters, ANSI/CSI sequences, and OSC sequences. Prefer a maintained terminal-string sanitization library where dependencies are permitted. 4. Apply sanitization independently to `trackingNumber`, `data.message`, `item.time`, `item.location`, and `item.context`. 5. Keep terminal-safe output separate from raw machine-readable data. If raw provider responses are needed, require an explicit option and write them using a structured format such as JSON. 6. Add tests containing ESC, BEL, CSI, OSC 8 hyperlink, and OSC 52 clipboard sequences to verify that no control sequence reaches `console.log()`. A defense-in-depth helper can reject or remove control characters before formatting: ```js function sanitizeTerminal(value) { return String(value) .replace(/\x1B\][^\x07]*(?:\x07|\x1B\\)/g, '') .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '') .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g, ''); } ``` This should supplement, not replace, strict validation of tracking-number syntax.