T09 · Insecure Skill Coding Practices
Note
- Location
scripts/meme.sh:3- Finding
Unquoted Input Permits Pathname Expansion and Argument Alteration
- Content
View full analysis
/dev/null || true; INPUT="$*" python3 -c ' ... ' "$CMD" $INPUT ``` ### Technical Analysis `$INPUT` is expanded without quotation marks when passed to Python. Bash consequently performs word splitting and pathname expansion before starting the Python process. For example, an input containing `*` may expand to filenames in the current working directory. The expanded filenames are then passed as separate Python arguments and can appear in the generated output. Whitespace and wildcard characters in legitimate captions may also change argument boundaries or otherwise corrupt the requested text. This is not direct shell-command injection: control operators produced by variable expansion are not reparsed as shell syntax. Nevertheless, the unsafe expansion can disclose filenames and produce unintended behavior. ### Attack Path 1. An attacker or untrusted caller supplies a caption or topic containing a shell wildcard, such as `*`. 2. The script combines the arguments into the `INPUT` variable. 3. The shell expands unquoted `$INPUT`, including glob patterns, against the current directory. 4. Matching local filenames are passed to Python as arguments. 5. Python joins and prints those arguments as part of the generated meme output. 6. The caller may consequently learn filenames from the directory in which the script was invoked. ### Impact Assessment Exploitation occurs with the privileges of the user running the script. It does not grant elevated privileges or direct file-content access, but it can expose local filenames, alter caption contents, and make command behavior dependent on the working directory. ]]>- Remediation
View remediation
/dev/null || true python3 -c ' import sys cmd = sys.argv[1] if len(sys.argv) > 1 else "help" inp = " ".join(sys.argv[2:]) # Remaining implementation ' "$CMD" "$@" ``` Quoting `"$@"` preserves argument boundaries and prevents pathname expansion. If a single reconstructed string is required, pass it as `"$INPUT"` rather than `$INPUT`. Add tests covering spaces, `*`, `?`, bracket expressions, leading hyphens, and empty input. ]]>