T09 · Insecure Skill Coding Practices
Error
- Location
scripts/amap.sh:38- Finding
Arbitrary Python Code Execution Through Unsafe Argument Interpolation
- Content
View full analysis
[city]}" city="${2:-}" url="$BASE/geocode/geo?key=$API_KEY&address=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$address'))")" [ -n "$city" ] && url="$url&city=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$city'))")" ``` The same issue occurs in the nearby-search handler: ```bash keywords="${3:?用法: amap.sh nearby }" radius="${4:-2000}" curl -s "$BASE/place/around?key=$API_KEY&location=$lng,$lat&keywords=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$keywords'))")&radius=$radius" | python3 -m json.tool ``` ### Technical Analysis The `address`, `city`, and `keywords` shell arguments are inserted directly into Python source code passed to `python3 -c`. Shell quoting prevents ordinary shell expansion of the values at that stage, but it does not make those values safe Python string literals. A value containing a single quote and Python syntax can terminate the intended string, close the surrounding function calls, and append arbitrary statements. For example, an input shaped like: ```text ')); __import__("os").system("id"); # ``` would cause the generated Python program to contain an attacker-controlled call to `os.system`. URL encoding therefore occurs only after the value has already been interpreted as Python source. This flaw affects every invocation path that performs URL encoding through this interpolation pattern: - `geocode` address - `geocode` city - `nearby` keywords The network response pipelines such as: ```bash curl -s "$url" | python3 -m json.tool ``` do not independently execute the downloaded response. They parse it as JSON and are not equivalent to `curl | bash`. The confirmed execution risk arises from local argument inte ...[truncated 1551 chars]- Remediation
View remediation