T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/cors_tester.py:225
- Finding
- Unsafe Input Interpolation in Generated Server Configurations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cors_tester.py:225-257`, `scripts/cors_tester.py:278-297` **Vulnerability Type**: Configuration and code injection through unsafe string interpolation **Risk Level**: Medium ### Vulnerable Code ```python "nginx": lambda o, m, h, c, ma: dedent(f"""\ # Nginx CORS configuration location / {{ if ($request_method = 'OPTIONS') {{ add_header 'Access-Control-Allow-Origin' '{o}'; add_header 'Access-Control-Allow-Methods' '{m}'; add_header 'Access-Control-Allow-Headers' '{h}'; {"add_header 'Access-Control-Allow-Credentials' 'true';" if c else ""} add_header 'Access-Control-Max-Age' {ma}; add_header 'Content-Type' 'text/plain; charset=utf-8'; add_header 'Content-Length' 0; return 204; }} add_header 'Access-Control-Allow-Origin' '{o}'; {"add_header 'Access-Control-Allow-Credentials' 'true';" if c else ""} }}"""), "apache": lambda o, m, h, c, ma: dedent(f"""\ # Apache .htaccess CORS configuration <IfModule mod_headers.c> Header set Access-Control-Allow-Origin "{o}" Header set Access-Control-Allow-Methods "{m}" Header set Access-Control-Allow-Headers "{h}" {"Header set Access-Control-Allow-Credentials true" if c else ""} Header set Access-Control-Max-Age "{ma}" </IfModule>"""), ``` ```python "rails": lambda o, m, h, c, ma: dedent(f"""\ # config/initializers/cors.rb Rails.application.config.middleware.insert_before 0, Rack::Cors do allow do origins {', '.join(f"'{x.strip()}'" for x in o.split(','))} resource '*', headers: :any, methods: [{', '.join(f':{x.strip().lower()}' for x in m.split(','))}], credentials: {'true' if c else 'false'}, max_age: {ma} end end"""), } def cmd_config(args): framework = args.framework if framework not in ...[truncated 3037 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse origins as structured URLs and allow only expected schemes such as `https` and, where explicitly required, `http`. 2. Reject origin values containing control characters, whitespace outside valid URL syntax, quotation marks, semicolons, braces, backticks, or line breaks. 3. Validate methods against an explicit allowlist of legitimate HTTP method tokens. 4. Validate header names against the HTTP field-name token grammar rather than accepting arbitrary text. 5. Use framework-specific string serialization instead of manually adding quotation marks. For Rails, generate valid escaped Ruby string literals. 6. Do not rely on generic escaping across all frameworks; Nginx, Apache, and Ruby have different grammars. 7. Refuse wildcard origins when credentials are enabled, or require an explicit override with a security warning. 8. Add negative tests using quotation marks, CR/LF characters, semicolons, braces, and embedded framework directives. 9. Clearly state that generated output must be reviewed and validated with the target server's configuration checker before deployment. ]]>