T09 · Insecure Skill Coding Practices
Warning
- Location
- baidu_scholar_search.sh:15
- Finding
- Unencoded User Input Allows Query-String Parameter Injection## Vulnerability Details **File Location**: `baidu_scholar_search.sh`, lines 15–32 **Vulnerability Type**: Query-string parameter injection caused by missing URL encoding and input validation **Risk Level**: Medium ### Vulnerable Code ```bash # Get search keyword (required) WD="$1" if [ -z "$WD" ]; then echo '{"error": "Missing search keyword parameter"}' exit 1 fi # Page number (default 0, i.e., first page) pageNum="${2:-0}" # Include abstract (default false, not included) enable_abstract="${3:-false}" # Send request curl -s -X GET \ -H "Authorization: Bearer $BAIDU_API_KEY" \ -H "X-Appbuilder-From: openclaw" \ "https://qianfan.baidubce.com/v2/tools/baidu_scholar/search?wd=$WD&pageNum=$pageNum&enable_abstract=$enable_abstract" ``` ### Technical Analysis The script places the user-controlled `WD`, `pageNum`, and `enable_abstract` values directly into an HTTP query string without URL encoding. Shell double-quoting prevents these values from being interpreted as separate shell commands, so this is not shell command injection. It does not, however, prevent reserved URL characters such as `&`, `=`, and `#` from changing the structure or interpretation of the request. Only the presence of `WD` is checked. The script does not verify that `pageNum` is a nonnegative integer or that `enable_abstract` is one of the documented Boolean values. Consequently, a caller can inject additional query parameters or submit unexpected values to the authenticated Baidu endpoint. ### Attack Path 1. An attacker or untrusted caller invokes the skill with a crafted keyword, for example: ```bash bash baidu_scholar_search.sh 'topic&enable_abstract=true&extra=value' 0 false ``` 2. The script interpolates the value directly into the request URL: ```text https://qianfan.baidubce.com/v2/tools/baidu_scholar/search?wd=topic&enable_abstract=true&extra=value&pageNum=0&enable_abstract=false ``` 3. The remote API receives attacker-injected parameters und ...[truncated 959 chars]
- Remediation
- ## Remediation Suggestions Use curl's native query-parameter encoding rather than constructing the query string through interpolation. Validate parameters against their documented formats before making the request. A hardened implementation could use: ```bash #!/bin/bash set -euo pipefail if [ -z "${BAIDU_API_KEY:-}" ]; then echo '{"error": "BAIDU_API_KEY environment variable not set"}' exit 1 fi WD="${1:-}" if [ -z "$WD" ]; then echo '{"error": "Missing search keyword parameter"}' exit 1 fi pageNum="${2:-0}" enable_abstract="${3:-false}" if ! [[ "$pageNum" =~ ^[0-9]+$ ]]; then echo '{"error": "page_number must be a nonnegative integer"}' exit 1 fi if [[ "$enable_abstract" != "true" && "$enable_abstract" != "false" ]]; then echo '{"error": "include_abstract must be true or false"}' exit 1 fi curl -sS --fail-with-body --get \ -H "Authorization: Bearer $BAIDU_API_KEY" \ -H "X-Appbuilder-From: openclaw" \ --data-urlencode "wd=$WD" \ --data-urlencode "pageNum=$pageNum" \ --data-urlencode "enable_abstract=$enable_abstract" \ "https://qianfan.baidubce.com/v2/tools/baidu_scholar/search" ``` This approach ensures that reserved characters in the search term are treated as data rather than query-string delimiters. It also restricts the other arguments to their documented types. Keep the destination origin fixed, continue using HTTPS, and avoid printing the authorization header or API key in diagnostic output.