T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze_logs.py:132- Finding
Terminal Escape-Sequence Injection Through Untrusted Log Content
- Content
View full analysis
120: example = example[:117] + "..." print(f" {example}") ``` ### Technical Analysis Log entries are commonly influenced by untrusted remote input, such as HTTP headers, request paths, usernames, protocol values, or application error messages. The analyzer retains the original log text in `error_examples` and later prints it directly to the terminal. Truncating the string does not neutralize embedded ANSI, OSC, C0, or C1 terminal control sequences. If a malicious log entry contains such sequences, a compatible terminal may interpret them as commands rather than displaying them as ordinary text. The JSON output path uses `json.dumps()`, which escapes standard control characters. The vulnerable path is the default human-readable output generated by `print_report()`. ### Attack Path 1. An attacker supplies crafted input to an application or service that records attacker-controlled values in its logs. 2. The crafted value includes terminal control sequences and a severity keyword such as `ERROR`, causing the analyzer to retain it as an error example. 3. An operator invokes `python3 scripts/analyze_logs.py ` without the `--json` option. 4. The analyzer reads the malicious line, stores up to 500 characters of the raw content, and selects it as an example for a top error pattern. 5. `print_report()` writes the content directly to the operator's terminal. 6. The terminal ...[truncated 917 chars]- Remediation
View remediation
str: return "".join( ch if ch.isprintable() else f"\\x{ord(ch):02x}" for ch in value ) ``` Apply it immediately before terminal output: ```python example = sanitize_terminal(err["example"]) if len(example) > 120: example = example[:117] + "..." print(f" {example}") ``` For stronger coverage, use a well-tested terminal sanitization routine that explicitly handles complete ANSI CSI and OSC sequences rather than relying only on a narrow regular expression. ]]>