T09 · Insecure Skill Coding Practices
Error
- Location
scripts/capture_via_app.py:27- Finding
AppleScript Injection Through the Python macOS Fallback
- Content
View full analysis
None: script = f''' tell application "System Events" tell process "{app_name}" set frontmost to true tell application "Finder" set desktopBounds to bounds of window of desktop end tell set screenW to item 3 of desktopBounds set screenH to item 4 of desktopBounds try set position of front window to {{60, 60}} set size of front window to {{screenW - 120, screenH - 140}} end try end tell end tell ''' run_applescript(script) ``` The same unsafe interpolation is used when obtaining window bounds: ```python def get_window_bounds(app_name: str) -> str: script = f''' tell application "System Events" tell process "{app_name}" set frontmost to true set winPos to position of front window set winSize to size of front window set x1 to item 1 of winPos set y1 to item 2 of winPos set w1 to item 1 of winSize set h1 to item 2 of winSize return (x1 as text) & "," & (y1 as text) & "," & (w1 as text) & "," & (h1 as text) end tell end tell ''' return run_applescript(script) ``` ### Technical Analysis The `--app` command-line argument is stored in `app_name` and inserted directly into AppleScript source through a Python formatted string. It is not escaped or validated before being placed inside the quoted `tell process` expression. A value containing AppleScript string delimiters and additional statements can alter the source code subsequently passed to: ```python subprocess.run( ["/usr/bin/osascript", "-e", script], ... ) ``` Using an argument-list subprocess p ...[truncated 1736 chars]- Remediation
View remediation