T09 · Insecure Skill Coding Practices
Error
- Location
scripts/should-dream.sh:97- Finding
Arbitrary Python Code Injection Through Unvalidated dreamChance State Value
- Content
View full analysis
/dev/null || echo "1") ``` ### Technical Analysis The `dreamChance` property is extracted from `data/dream-state.json` using `jq -r` without validating its JSON type, numeric range, or syntax. Its resulting text is then directly interpolated into the source code supplied to `python3 -c`. Because the value becomes part of executable Python source rather than being passed as data, a crafted `dreamChance` value can terminate or alter the expected expression and introduce attacker-selected Python operations. This creates an arbitrary code-execution primitive whenever the script reaches the probability check. The fallback behavior `|| echo "1"` also fails open. If Python encounters an error, the script treats the roll as successful, although this fallback is secondary to the direct code-injection risk. Exploitation requires the attacker to modify `data/dream-state.json` or otherwise control the state file resolved through `WORKSPACE`. ### Attack Path 1. An attacker obtains write ...[truncated 1426 chars]- Remediation
View remediation
= 0 and . <= 1) ' "$STATE_FILE"); then echo "Error: dreamChance must be a number between 0 and 1" >&2 exit 1 fi if ! ROLL=$(python3 - "$DREAM_CHANCE" <<'PY' import random import sys try: chance = float(sys.argv[1]) except (ValueError, IndexError): raise SystemExit(1) if not 0.0 <= chance <= 1.0: raise SystemExit(1) print(1 if random.random() < chance else 0) PY ); then echo "Error: unable to calculate dream probability" >&2 exit 1 fi ``` This approach treats the state value as input data, validates its permitted range, and prevents it from changing the Python program being executed. ]]>