T09 · Insecure Skill Coding Practices
Warning
- Location
" && exit 1 [ ! -f "$file" ] && echo "File not found: $file" && exit 1 CR_FILE="$file" CR_LANG="$lang" python3 << 'PYEOF' import re with open("$file") as f: content = f.read() ``` The same defects occur in the complexity command: ```bash cmd_complexity() { local file="${1:-}" [ -z "$file" ] && echo "Usage: complexity <file>" && exit 1 [ ! -f "$file" ] && echo "File not found: $file" && exit 1 CR_FILE="$file" CR_LANG="$lang" python3 << 'PYEOF' import re, os with open("$file" ...[truncated 2404 chars]:257- Finding
Security and Complexity Commands Fail Before Analyzing the Requested File
- Content
View full analysis
" && exit 1 [ ! -f "$file" ] && echo "File not found: $file" && exit 1 CR_FILE="$file" CR_LANG="$lang" python3 << 'PYEOF' import re with open("$file") as f: content = f.read() ``` The same defects occur in the complexity command: ```bash cmd_complexity() { local file="${1:-}" [ -z "$file" ] && echo "Usage: complexity " && exit 1 [ ! -f "$file" ] && echo "File not found: $file" && exit 1 CR_FILE="$file" CR_LANG="$lang" python3 << 'PYEOF' import re, os with open("$file") as f: lines = f.readlines() ``` ### Technical Analysis The script enables strict undefined-variable handling through `set -euo pipefail`. Neither `cmd_security` nor `cmd_complexity` initializes a shell variable named `lang`, but both evaluate `CR_LANG="$lang"` while constructing the Python process environment. Consequently, Bash terminates the command with an unbound-variable error before Python can perform any analysis. There is a second independent defect. The Python source is supplied using a single-quoted heredoc delimiter: ```bash << 'PYEOF' ``` This intentionally disables shell expansion inside the heredoc. Therefore, `open("$file")` does not reference the validated shell argument; Python attempts to open a literal path named `$file`. The shell correctly exports the requested path through `CR_FILE`, but the embedded Python ignores that environment variable. This breaks the advertised security control and may cause users or automation to proceed without a completed scan. ### Attack Path 1. A user or automated pipeline invokes `security target.py` or `complexity targ ...[truncated 1184 chars]- Remediation
View remediation
"; return 1; } [ ! -f "$file" ] && { echo "File not found: $file"; return 1; } CR_FILE="$file" python3 <<'PYEOF' import os import re filepath = os.environ["CR_FILE"] with open(filepath, encoding="utf-8") as f: content = f.read() lines = content.splitlines() PYEOF } ``` Apply the same design to `cmd_complexity`. Remove `CR_LANG="$lang"` unless the function initializes and uses `lang`. Additional hardening should include: 1. Add automated tests for valid files, missing files, filenames containing spaces, and filenames beginning with a dash. 2. Assert that each command returns a nonzero exit status when analysis fails. 3. Ensure calling automation treats any nonzero status as a failed scan rather than a clean result. 4. Print scan results using the resolved `filepath` value so output accurately identifies the analyzed target. ]]>