T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audio_run.sh:35- Finding
Arbitrary Shell Command Execution Through Unsafe eval
- Content
View full analysis
/tmp/pwned' ``` 2. The input does not match the supported Chinese audio-command patterns. 3. The fallback branch emits `id > /tmp/pwned` unchanged. 4. Command substitution assigns that text to `AUDIO_CMD`. 5. `eval "$AUDIO_CMD"` parses and executes the payload. 6. The output of `id` is written to `/tmp/pwned`, demonstrating arbitrary command execution. A malicious output argument can also inject commands into a recognized operation because the output is concatenated into an FFmpeg command string and subsequently evaluat ...[truncated 783 chars]- Remediation
View remediation
&2 return 1 fi ``` 3. Invoke FFmpeg directly using separately quoted arguments: ```bash ffmpeg -y -i "$input" -vn -acodec mp3 "$output" ``` 4. Represent commands as Bash arrays if commands must be assembled dynamically: ```bash args=(ffmpeg -y -i "$input" -vn -acodec mp3 "$output") "${args[@]}" ``` 5. Validate all inputs: - Require input files to use explicitly supported media extensions. - Resolve and restrict paths to approved directories where appropriate. - Reject missing files and non-regular files. - Validate volume as a numeric value within an explicitly permitted range. - Reject output paths containing control characters and enforce an approved destination policy. 6. Use `set -euo pipefail` and quote every variable expansion, while recognizing that quoting alone does not make `eval` safe. 7. Add regression tests using command separators, substitutions, redirections, and crafted output paths to ensure they are treated as data rather than executable syntax. ]]>