T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/deploy.sh:107
- Finding
- Arbitrary Command Execution Through Unvalidated Bash Array Subscripts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy.sh`, lines 107-119 **Vulnerability Type**: Bash arithmetic array-subscript injection **Risk Level**: Critical ### Vulnerable Code ```bash TEAMS="" TEAM_MEMBERS="" read -p "要创建几个团队？[1-10]: " team_count if ! [[ "$team_count" =~ ^[0-9]+$ ]] || [ "$team_count" -lt 1 ] || [ "$team_count" -gt 10 ]; then log_error "团队数量必须在 1-10 之间" exit 1 fi for ((i=1; i<=team_count; i++)); do echo "" log_step "配置第 $i 个团队" read -p "团队 ID (英文，如 code/stock): " team_id read -p "团队名称 (中文，如 代码开发团队): " team_name read -p "团队领导角色 (如 CTO/CIO): " team_role read -p "团队成员 (逗号分隔，如 frontend,backend,test): " members TEAMS="$TEAMS $team_id" TEAM_MEMBERS["$team_id"]="$members" ``` ### Technical Analysis `TEAM_MEMBERS` is initialized as a scalar value instead of being declared as an associative array. Consequently, Bash treats the later `TEAM_MEMBERS["$team_id"]` operation as an indexed-array assignment. Indexed-array subscripts are evaluated as Bash arithmetic expressions. Arithmetic evaluation can perform additional expansion of attacker-controlled content. Because `team_id` is read directly from interactive input without validation, a malicious array subscript can cause command substitution or other unintended shell evaluation during the assignment. The documentation specifies an identifier format but the script does not enforce it. Quoting `"$team_id"` inside the array syntax does not convert an indexed array into an associative array and does not eliminate arithmetic evaluation. ### Attack Path 1. An attacker or untrusted operator starts `scripts/deploy.sh`. 2. The attacker selects custom-team configuration. 3. The attacker enters a syntactically valid team count. 4. For the team ID, the attacker supplies an arithmetic-array expression containing shell expansion or command substitution. 5. Bash evaluates the untrusted subscript while executing: `TEAM_MEMBERS["$team_id"]="$ ...[truncated 687 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare the collection as an associative array before any assignment: ```bash declare -A TEAM_MEMBERS=() ``` 2. Enforce a strict identifier allowlist: ```bash if [[ ! "$team_id" =~ ^[a-z][a-z0-9_-]{0,63}$ ]]; then log_error "Invalid team ID" exit 1 fi ``` 3. Read input without processing backslash escapes: ```bash read -r -p "Team ID: " team_id ``` 4. Apply equivalent validation to every member identifier. 5. Do not rely on documentation as an input-control mechanism. 6. Run the deployment script under a dedicated, minimally privileged account rather than root. 7. Add automated tests for command substitutions, arithmetic expressions, quotes, whitespace, and metacharacters in identifiers. ]]>