T09 · Insecure Skill Coding Practices
Error
- Location
scripts/shellguard-scanner.sh:340- Finding
Arbitrary Python Code Execution Through Crafted Scanned Filenames
- Content
View full analysis
/dev/null; then local zwc_count zwc_count=$(python3 -c " import sys, unicodedata text = open('$file', 'r', errors='replace').read() zwc = [c for c in text if unicodedata.category(c) == 'Cf' or ord(c) in (0x200B,0x200C,0x200D,0xFEFF,0x00AD,0x2060,0x180E)] print(len(zwc)) " 2>/dev/null || echo "0") if (( zwc_count > 0 )); then add_finding "TIER3-OBFUSCATION" "$fname — CRITICAL: $zwc_count zero-width/invisible characters (steganography)" score_add SCORE_OBFUSCATION 15 20 fi fi # Bidirectional control characters if python3 -c " import sys text = open('$file', 'r', errors='replace').read() bidi = [c for c in text if ord(c) in (0x202E,0x202D,0x202A,0x202B,0x2066,0x2067,0x2068,0x202C,0x2069)] sys.exit(0 if bidi else 1) " 2>/dev/null; then add_finding "TIER3-OBFUSCATION" "$fname — CRITICAL: Bidirectional override characters (text spoofing attack)" score_add SCORE_OBFUSCATION 18 20 fi # Unicode tag range (U+E0000..E007F) — invisible instruction injection if python3 -c " import sys text = open('$file', 'r', errors='replace').read() tags = [c for c in text if 0xE0000 <= ord(c) <= 0xE007F] sys.exit(0 if tags else 1) " 2>/dev/null; then add_finding "TIER3-OBFUSCATION" "$fname — CRITICAL: Unicode tag characters (U+E0000 range) — invisible content injection" score_add SCORE_OBFUSCATION 20 20 fi ``` ### Technical Analysis The scanner embeds the value of `$file` directly inside Python source passed to `python3 -c`. Although the shell expands `$file` inside a double-quoted shell string, the resulting value is placed between single quotes in this Python statement: ```python text = open('$file', 'r', errors='repla ...[truncated 2330 chars]- Remediation
View remediation