T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/scan.sh:40
- Finding
- Unescaped Attacker-Controlled Data in JSON and Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/scan.sh`, lines 40-62 **Vulnerability Type**: Improper output encoding and terminal control-sequence injection **Risk Level**: Medium ### Vulnerable Code ```bash if [ "$JSON_MODE" == "--json" ]; then echo "{\"token\": \"$TOKEN\", \"risk_score\": $risk_score, \"is_copycat\": $is_copycat, \"analyze\": $analyze, \"copycat\": $copycat}" exit 0 fi # Pretty print cat << EOF 🛡️ PRISM Token Scan: $TOKEN ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ RISK SCORE: $risk_score/100 $bar $risk_level ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ANALYSIS: $(echo "$analyze" | jq -r '.summary // "No summary available"') COPYCAT CHECK: $(if [ "$is_copycat" == "true" ]; then echo "🚨 COPYCAT DETECTED (${similarity}% similar)"; else echo "✅ No copycat detected"; fi) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚠️ DYOR - This is not financial advice EOF ``` ### Technical Analysis The script directly interpolates the user-controlled `TOKEN` value into manually constructed JSON. JSON metacharacters such as quotation marks, backslashes, and control characters are not escaped. Consequently, a crafted token can make `--json` output syntactically invalid or inject additional properties into the resulting object. The same token is printed directly to the terminal in normal output mode. In addition, the `.summary` field returned by the remote PRISM API is extracted with `jq -r` and emitted without filtering terminal control characters. If either source contains ANSI escape sequences or other control characters, the output can alter terminal presentation, conceal preceding content, spoof status messages, or contaminate logs. The shell expansions are quoted or occur within a here-document and are not passed to `eval` or another shell interpreter. Therefore, the reviewed code does not establish shell command injection or local code execution. ### Attack Path #### JSON injection 1. An attacker supplies a crafted token containing JSON delimiters, quotation mar ...[truncated 1854 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Construct JSON with `jq` instead of string concatenation: ```bash jq -n \ --arg token "$TOKEN" \ --argjson risk_score "$risk_score" \ --argjson is_copycat "$is_copycat" \ --argjson analyze "$analyze" \ --argjson copycat "$copycat" \ '{ token: $token, risk_score: $risk_score, is_copycat: $is_copycat, analyze: $analyze, copycat: $copycat }' ``` 2. Validate that API responses are valid JSON before processing them: ```bash if ! jq -e . >/dev/null 2>&1 <<<"$analyze"; then echo "Error: invalid analysis response" >&2 exit 1 fi ``` Apply equivalent validation to `copycat`. 3. Validate input according to supported formats. Permit only expected token-symbol characters or recognized EVM/Solana address formats, and impose a reasonable maximum length. 4. Remove non-printable control characters before displaying user-controlled or remote text. Alternatively, render such characters in an escaped representation rather than sending them directly to a terminal. 5. Validate response field types and ranges. In particular, require `risk_score` and `similarity` to be numeric and constrain risk scores to the documented range before numeric comparisons. 6. Use explicit `curl` failure handling, timeouts, and HTTPS-only behavior, such as `--fail --show-error --max-time`, and terminate safely if an API request or response validation fails. ]]>