T09 · Insecure Skill Coding Practices
Error
- Location
tools/audit-npm-package.sh:46- Finding
Attacker-Controlled Repository Metadata Can Inject Git Command-Line Arguments
- Content
View full analysis
&1 | grep -E "Cloning|Receiving" || echo "Repository clone failed or not needed" else echo "⚠️ No GitHub repository found in package metadata" fi ``` ### Technical Analysis The repository URL originates from npm registry metadata controlled by the package publisher. The value is expanded without quotes in the `git clone` command: ```bash git clone --depth 50 $REPO_URL github-repo ``` Unquoted shell expansion performs word splitting and pathname expansion. A malicious metadata value containing whitespace can therefore become multiple Git arguments rather than one repository URL. Tokens beginning with `-` may be interpreted as Git options. Git clone supports options and configuration values that influence transports and protocol handling. Consequently, crafted metadata could alter clone behavior, select an unintended transport, or attempt to activate a dangerous Git protocol or helper. The precise impact depends on the installed Git version, enabled protocols, and local configuration, but package metadata must not be allowed to control Git options. The script also does not restrict repositories to trusted HTTPS hosts. This exceeds the minimum network privileges required for source comparison because the audit may connect to an arbitrary host or transport selected by an untrusted package publisher. ### Attack Path 1. An attacker publishes an npm package ...[truncated 1496 chars]- Remediation
View remediation
&2 exit 1 ;; esac case "$REPO_URL" in *[[:space:][:cntrl:]]*) echo "Rejected malformed repository URL" >&2 exit 1 ;; esac ``` 3. Disable dangerous protocols explicitly where supported: ```bash git \ -c protocol.file.allow=never \ -c protocol.ext.allow=never \ clone --depth 50 --end-of-options "$REPO_URL" github-repo ``` 4. Avoid inheriting credentials for arbitrary hosts. Run Git with an isolated configuration and disabled credential helper when authentication is unnecessary. 5. Treat absent, malformed, or non-allowlisted repository metadata as a manual-review condition rather than attempting the clone. ]]>