T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/transcribe_large.sh:42
- Finding
- Python Code Injection Through an Unsafely Interpolated Audio Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe_large.sh:42-49` **Vulnerability Type**: Python code injection through heredoc interpolation **Risk Level**: High ### Vulnerable Code ```bash /usr/bin/python3 << EOF import sys sys.path.insert(0, "$SCRIPT_DIR") from transcriber import Transcriber translation_mode = $([[ -n "$TRANSLATE" ]] && echo "True" || echo "False") t = Transcriber(backend='mlx', model='distil-large-v3', translation_mode=translation_mode) result = t.transcribe("$AUDIO_FILE") print(result) EOF ``` ### Technical Analysis `AUDIO_FILE` and `SCRIPT_DIR` are expanded by the shell directly into Python source code. Although the variables appear between Python quotation marks, their contents are not escaped according to Python string-literal rules. A crafted filename containing quotation marks, newlines, backslashes, or valid Python syntax can terminate the string passed to `t.transcribe()` and inject additional Python statements. The initial shell file-existence check does not prevent exploitation because macOS files can contain characters that are significant in Python source. This is not conventional shell command injection; it is source-code generation followed by execution by `/usr/bin/python3`. ### Attack Path 1. An attacker creates or supplies an audio file with a filename containing Python string-termination characters and additional Python syntax. 2. The victim invokes `scripts/transcribe_large.sh` with that file. 3. The shell confirms that the crafted path refers to an existing file. 4. The path is interpolated into the unquoted heredoc. 5. Python parses the attacker-controlled portion as source code. 6. The injected code executes with the same user privileges as the transcription process. ### Impact Assessment Successful exploitation permits arbitrary Python execution under the invoking user account. The injected code could read or modify user-accessible files, execute local commands, access environment var ...[truncated 206 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not embed paths or other externally controlled values in generated Python source. Pass them as arguments to Python and quote the heredoc delimiter: ```bash /usr/bin/python3 - "$SCRIPT_DIR" "$AUDIO_FILE" "$TRANSLATE" <<'PY' import sys script_dir = sys.argv[1] audio_file = sys.argv[2] translation_mode = sys.argv[3] == "--translate" sys.path.insert(0, script_dir) from transcriber import Transcriber transcriber = Transcriber( backend="mlx", model="distil-large-v3", translation_mode=translation_mode, ) print(transcriber.transcribe(audio_file)) PY ``` Alternatively, replace the shell-generated Python entirely with `transcriber_cli.py`. Add regression tests using filenames containing quotation marks, backslashes, spaces, Unicode characters, dollar signs, and newlines. ]]>