T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert_audio.sh:53- Finding
Command and Argument Injection Through Unvalidated Audio Quality Input
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 2. **Apply format-specific numeric ranges.** For example, reject zero, negative, excessively large, or otherwise unsupported bitrate values. For OGG, calculate the mapped quality only after validation and clamp or reject results outside ffmpeg's accepted range. ```bash if (( QUALITY < 1 || QUALITY > 512 )); then echo "Error: Quality is outside the supported range." >&2 exit 1 fi ``` 3. **Use a Bash array for ffmpeg options instead of constructing a string.** ```bash qual_opts=() case "$OUT_EXT" in mp3) CODEC="libmp3lame" if [[ -n "$QUALITY" ]]; then qual_opts=(-b:a "${QUALITY}k") else qual_opts=(-qscale:a 2) fi ;; ogg) CODEC="libvorbis" if [[ -n "$QUALITY" ]]; then ogg_quality=$((10#$QUALITY / 40)) qual_opts=(-qscale:a "$ogg_quality") else qual_opts=(-qscale:a 5) fi ;; esac ffmpeg -y -v warning -i "$INPUT" -codec:a "$CODEC" \ "${qual_opts[@]}" "$OUTPUT" ``` 4. **Use `10#` for validated decimal arithmetic** to prevent values with leading zeroes from being interpreted under an unintended numeric base. 5. **Reject unexpected argument counts** so trailing or malformed inputs cannot be silently ignored. 6. **Consider restricting ffmpeg protocols** if the Skill only needs local file conversion. A suitable protocol allowlist reduces the impact of future ffmpeg argument-handling defects. 7. **Add regression tests** covering nonnumeric values, whitespace, shell metacharacters, arithmetic expressions, command substitutions, negative numbers, leading zeroes, and out-of-range values. The tests should verify that validation fails before ffmpeg is invoked. ]]>