T09 · Insecure Skill Coding Practices
Error
- Location
block_generator.py:23- Finding
Untrusted parameters can inject executable PLC source code
- Content
View full analysis
Vulnerability Details
File Location:
actions.py:93-108,block_generator.py:23-34, andtemplates/fb_template.txt:1-18
Vulnerability Type: PLC source-code injection through unsafe template interpolation
Risk Level: HighVulnerable Code
actions.py:93-108:python plc_name = params.get("plc_name") block_type = params.get("block_type") block_name = params.get("block_name") description = params.get("description", "") number = params.get("number", 0) language = params.get("language", "SCL") if not plc_name or not block_type or not block_name: return {"success": False, "message": "Missing required parameters"} try: plc_software = tia.get_plc_software(plc_name) scl_code = _scl_gen.generate(block_type, block_name, description) block = tia.create_block( plc_software, block_type, block_name, number, language, scl_code )block_generator.py:23-34:python analysis = self._analyze_description(description) template = self.env.get_template( f"{block_type.lower()}_template.txt" ) code = template.render( block_name=name, description=description, variables=analysis.get("variables", []), logic=analysis.get("logic", ""), parameters=parameters or {} ) return codetemplates/fb_template.txt:1-18:jinja2 FUNCTION_BLOCK "{{ block_name }}" // {{ description }} VAR_INPUT {% for var in variables if var.direction == 'input' %} {{ var.name }} : {{ var.type }}; {% endfor %} END_VAR VAR_OUTPUT {% for var in variables if var.direction == 'output' %} {{ var.name }} : {{ var.type }}; {% endfor %} END_VAR VAR // Internal variables END_VAR BEGIN {{ logic }} END_FUNCTION_BLOCKThe same direct interpolation pattern is present in
templates/fc_template.txt,templates/ob_template.txt, andtemplates/db_template.txt.Technical Analysis
...[truncated 2356 chars]
- Remediation
View remediation
Remediation Suggestions
- Implement strict allowlist validation for block and variable identifiers according to Siemens SCL naming rules. Reject quotes, newlines, comment delimiters, control characters, and unsupported Unicode characters.
- Do not insert raw descriptions into source code. Convert every line into a separately prefixed comment and reject carriage returns or other control characters.
- Build declarations and logic through typed source-generation functions rather than direct string interpolation.
- Validate
block_typeandlanguageagainst explicit allowlists before using them as template names or dictionary keys. - Parse or compile generated SCL in a non-deployment validation stage and present the complete generated source for review.
- Require explicit approval of the generated source before compilation and deployment.
- Add tests covering multiline descriptions, quotes, comment delimiters, malformed identifiers, and attempted SCL statement injection.