T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/auth-flow.sh:43- Finding
Remote API responses are interpolated into executable Python source
- Content
View full analysis
/dev/null; then # 保存 credentials mkdir -p "$HOME/.caremax" python3 -c " import json from datetime import datetime, timedelta resp = json.loads('''$TOKEN_RESPONSE''') creds = { 'access_token': resp['access_token'], 'refresh_token': resp['refresh_token'], 'expires_at': (datetime.utcnow() + timedelta(seconds=resp['expires_in'])).isoformat() + 'Z', 'scope': resp['scope'], 'base_url': '$BASE_URL' } json.dump(creds, open('$CREDS_FILE', 'w'), indent=2) print(json.dumps({'status': 'authorized', 'access_token': resp['access_token'], 'base_url': '$BASE_URL'})) " ``` `scripts/refresh-token.sh:18-34`: ```bash if echo "$RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'access_token' in d" 2>/dev/null; then python3 -c " import json from datetime import datetime, timedelta resp = json.loads('''$RESPONSE''') creds = json.load(open('$CREDS_FILE')) creds['access_token'] = resp['access_token'] creds['expires_at'] = (datetime.utcnow() + timedelta(seconds=resp['expires_in'])).isoformat() + 'Z' json.dump(creds, open('$CREDS_FILE', 'w'), indent=2) print(json.dumps({ 'status': 'refreshed', 'access_token': resp['access_token'], 'base_url': creds.get('base_url', 'https://api.caremax.ai') })) " ``` ### Technical Analysis Both scripts retrieve JSON from a remote endpoint and first confirm that the response parses as JSON and contains an `access_token`. They subsequently interpolate the original, untrusted response directly into the source text passed to `python3 -c`. JSON validation does not make this interpolation safe. A valid JS ...[truncated 2276 chars]- Remediation
View remediation