T09 · Insecure Skill Coding Practices
Error
- Location
orchestrator.sh:342- Finding
Arbitrary Python Code Execution Through Unsanitized Workflow Arguments
- Content
View full analysis
/dev/null; then jq --arg s "$step" '.completed_steps += [$s] | .current_step = ""' "$state_file" > "${state_file}.tmp" && mv "${state_file}.tmp" "$state_file" elif command -v python3 &>/dev/null; then python3 -c " import json with open('$state_file') as f: state = json.load(f) state['completed_steps'].append('$step') state['current_step'] = '' with open('$state_file', 'w') as f: json.dump(state, f, indent=2) " else echo -e "${RED}⛔ 需要 jq 或 python3 来管理状态${NC}" exit 1 fi } advance_step() { local next_step="$1" local state_file="${CHECKPOINT_DIR}/session.json" if command -v jq &>/dev/null; then jq --arg s "$next_step" '.current_step = $s' "$state_file" > "${state_file}.tmp" && mv "${state_file}.tmp" "$state_file" elif command -v python3 &>/dev/null; then python3 -c " import json with open('$state_file') as f: state = json.load(f) state['current_step'] = '$next_step' with open('$state_file', 'w') as f: json.dump(state, f, indent=2) " fi } ``` ### Technical Analysis The `--complete` and `--next` command-line values are assigned to `step` and `next_step`, then directly interpolated into source code passed to `python3 -c`. Shell quoting does not make these values safe inside the generated Python program. A value containing a single quote can terminate the intended Python string literal and inject additional Python statements. For example, a value shaped like: ```text x'); __import__("os").system("id"); # ``` would transform the relevant generated statement into code equivalent to: ```python state['completed_steps'].append( ...[truncated 2464 chars]- Remediation
View remediation
&2 exit 2 ;; esac } ``` 2. Parse and validate the `--next` option explicitly rather than assuming that the fourth positional argument contains its value. 3. Verify that transitions follow the expected sequence instead of allowing arbitrary steps to be marked complete. 4. Use one safe state-update implementation consistently rather than maintaining separate security behavior for `jq` and Python environments. 5. Add regression tests containing quotes, newlines, semicolons, comment markers, and Python expressions in both arguments. Confirm that invalid values are rejected and never interpreted as code. ]]>