T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sync_gen.py:29
- Finding
- Generated Python Code Injection Through Unsanitized Race Name## Vulnerability Details **File Location**: `scripts/sync_gen.py:29-36` **Vulnerability Type**: Generated-code injection **Risk Level**: High ### Vulnerable Code ```python for plan in TRAINING_PLAN: event_date = race_date - datetime.timedelta(days=plan["days_before"]) date_str = event_date.strftime("%Y-%m-%d") summary = f"{plan['summary']} - {race_name}" desc = plan['description'] script_content += f'\n {{"date": "{date_str}", "summary": "{summary}", "description": "{desc}"}},' script_content += """ ``` ### Technical Analysis The command-line `race_name` value is interpolated directly into generated Python source code. It is not escaped or serialized as a safe Python string literal. A race name containing quotation marks, backslashes, newlines, or Python syntax can terminate the intended string and inject additional statements into the generated program. The generated output is designed to be saved and executed to synchronize Calendar events. Consequently, this is not merely malformed output: execution of the generated file can run injected Python with the current user's privileges. ### Attack Path 1. An attacker supplies or persuades the user to use a crafted race name containing Python syntax. 2. The user invokes `sync_gen.py` with that value. 3. The script embeds the value into the generated `events` Python list without escaping it. 4. The generated output is saved as a Python file, as anticipated by the documented synchronization workflow. 5. When that file is executed, the injected Python statements run under the user's account. ### Impact Assessment Successful exploitation permits arbitrary Python code execution with the privileges of the user running the generated script. This can expose Garmin tokens, health and location data, local files, Calendar contents, and other resources accessible to that account. It could also be used to execute subprocesses or modify user files.
- Remediation
- ## Remediation Suggestions - Avoid generating executable Python. Synchronize Calendar events directly from the original process using structured event objects. - If code generation is unavoidable, serialize every inserted value with a safe serializer such as `repr()` or `json.dumps()` rather than constructing source literals manually. - Reject control characters and unexpected newline sequences in user-provided names. - Independently escape values before embedding them in AppleScript; Python escaping alone does not make a value safe for another language. - Add tests using quotes, backslashes, newlines, braces, and attempted Python or AppleScript payloads. - Require explicit user confirmation before modifying Calendar data.