T09 · Insecure Skill Coding Practices
Error
- Location
scripts/supernote.sh:44- Finding
Arbitrary Python Code Execution Through Unsafe Shell Interpolation
- Content
View full analysis
time.time() + 3600: sys.exit(0) else: sys.exit(1) except: sys.exit(1) " 2>/dev/null } ``` ```bash HASHED_PASS=$(python3 -c " import hashlib md5 = hashlib.md5('$SUPERNOTE_PASSWORD'.encode()).hexdigest() print(hashlib.sha256((md5 + '$RANDOM_CODE').encode()).hexdigest()) ") ``` ```bash FOUND_ID=$(echo "$RESP" | python3 -c " import sys, json data = json.load(sys.stdin) target = '$PART' for item in data.get('userFileVOList', data.get('data', {}).get('userFileVOList', [])): if item.get('fileName') == target and item.get('isFolder') == 'Y': print(item['id']) break " 2>/dev/null) ``` ```bash FILE_MD5=$(python3 -c "import hashlib; print(hashlib.md5(open('$FILE_PATH','rb').read()).hexdigest())") ``` ### Technical Analysis The script inserts shell variables directly into Python source passed to `python3 -c`. Shell quoting does not make these values safe inside a Python string literal. A single quote, backslash, newline, or other Python syntax in one of the interpolated values can terminate the intended string and alter the executed program. Affected values include: - `$PART`, derived from the user-controlled `--path` argument. - `$FILE_PATH`, derived from the user-controlled `--file` argument. - `$SUPERNOTE_PASSWORD`, supplied through the environment. - `$TOKEN`, read from a predictable local token file or returne ...[truncated 1659 chars]- Remediation
View remediation
time.time() + 3600 else 1) except Exception: raise SystemExit(1) ' "$TOKEN" ``` Apply the same pattern to every affected value: - Pass `$SUPERNOTE_PASSWORD` and `$RANDOM_CODE` as separate `sys.argv` entries. - Pass `$PART` as an argument while keeping the API response on standard input. - Pass `$FILE_PATH` as an argument rather than placing it inside `open('...')`. - Prefer a dedicated Python helper file over several dynamically constructed `python3 -c` programs. - Add regression tests using values containing quotes, backslashes, newlines, Unicode, and shell/Python metacharacters. - Avoid executing the Skill with administrative privileges. ]]>