T09 · Insecure Skill Coding Practices
Warning
- Location
- equity_scorer.py:766
- Finding
- Shell Injection in Generated Reproducibility Command<![CDATA[ ## Vulnerability Details **File Location**: `equity_scorer.py:766-770`, with attacker-controlled interpolation values assigned at `equity_scorer.py:782` and `equity_scorer.py:815` **Vulnerability Type**: Shell command injection through an unsafe generated command **Risk Level**: Medium ### Vulnerable Code ```python ## Reproducibility ```bash # Re-run this analysis python equity_scorer.py --input %(input_name)s --output %(output_name)s ``` ``` The values interpolated into this command are derived from command-line-controlled paths without shell escaping: ```python "input_name": input_path.name, ``` ```python "output_name": output_dir.name, ``` ### Technical Analysis The generated Markdown report includes a shell command intended to reproduce the analysis. The input filename and output directory basename are inserted directly into that command without quoting or escaping them for the target shell. On operating systems that permit shell metacharacters in filenames, an attacker can provide a valid CSV or VCF whose filename contains command substitution, command separators, redirections, or other shell syntax. For example, a file named: ```text $(touch PWNED).csv ``` would result in a report containing a command resembling: ```bash python equity_scorer.py --input $(touch PWNED).csv --output equity_report ``` If a user copies or executes this documented command in a shell, the embedded command substitution is evaluated. The report-generation process does not itself execute the command, so successful exploitation requires the report recipient to run the reproducibility command. ### Attack Path 1. An attacker creates a syntactically valid ancestry CSV or VCF with a filename containing shell syntax. 2. The victim runs Equity Scorer against the attacker-provided file. 3. `generate_report()` takes `input_path.name` and inserts it directly into the Markdown shell block. 4. The resulting `report.md` appears to contain a legitimate reproducibility com ...[truncated 812 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Apply shell-safe quoting to every generated argument with `shlex.quote()`: ```python import shlex safe_input = shlex.quote(str(input_path)) safe_output = shlex.quote(str(output_dir)) ``` - Generate the command from safely quoted full paths rather than unquoted basenames. - Consider emitting a Python argument list instead of a shell command when practical. - Clearly state that generated commands should be reviewed before execution. - Add regression tests covering filenames and output directories containing: - Spaces - Single and double quotes - Semicolons - Dollar signs and command substitutions - Redirection characters - Newlines - Verify that copying the generated command results only in the intended arguments being passed to `equity_scorer.py`. ]]>