T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/search_arxiv.sh:3
- Finding
- Unvalidated Input Is Interpolated into a curl URL## Vulnerability Details **File Location**: `scripts/search_arxiv.sh`, lines 3–6 **Vulnerability Type**: Improper input validation and unsafe URL construction **Risk Level**: Low ```bash QUERY=$1 COUNT=${2:-5} # Use curl to query ArXiv API curl -sL "https://export.arxiv.org/api/query?search_query=all:$QUERY&start=0&max_results=$COUNT&sortBy=submittedDate&sortOrder=descending" ``` ### Technical Analysis The script accepts a query and an optional result count, then interpolates both values directly into a URL without validation or URL encoding. An attacker-controlled `QUERY` can contain URL query delimiters such as `&`, allowing additional API parameters to be introduced or existing request semantics to be changed. Curl URL-globbing characters, including braces or brackets, may also cause curl to expand a single apparent URL into multiple requests. `COUNT` is not restricted to a bounded positive integer. A malformed or excessive value could alter request semantics, cause failures, or request an unnecessarily large response. Because the expanded variables remain inside a quoted shell word, ordinary shell metacharacters or command substitutions contained in the variables are not reevaluated as shell syntax. Therefore, the observed code does not establish direct shell-command injection. ### Attack Path 1. An attacker or untrusted caller supplies a crafted first argument containing URL delimiters or curl globbing syntax, or supplies an excessive second argument. 2. The script assigns these values to `QUERY` and `COUNT` without validation. 3. Both values are embedded unchanged in the curl URL. 4. Curl interprets the resulting URL, potentially sending altered or multiple requests to the hard-coded ArXiv endpoint. 5. The requests may consume excessive bandwidth or processing time, return unintended result sets, or cause the invocation to fail. ### Impact Assessment Exploitation can modify the semantics or amplify the ...[truncated 532 chars]
- Remediation
- ## Remediation Suggestions - Validate `COUNT` as a decimal positive integer and enforce a conservative upper bound. - Construct query parameters with `curl --get` and `--data-urlencode` instead of string interpolation. - Disable curl URL globbing with `--globoff`. - Add connection and total-request timeouts. - Enforce an acceptable response-size limit in the calling workflow. - Use strict shell settings and reject missing or malformed arguments. Example hardened implementation: ```bash #!/usr/bin/env bash set -euo pipefail QUERY=${1:?A search query is required} COUNT=${2:-5} if [[ ! "$COUNT" =~ ^[0-9]+$ ]] || (( COUNT < 1 || COUNT > 100 )); then printf 'COUNT must be an integer between 1 and 100\n' >&2 exit 2 fi curl --silent --show-error --location --fail --globoff \ --connect-timeout 10 \ --max-time 30 \ --get 'https://export.arxiv.org/api/query' \ --data-urlencode "search_query=all:${QUERY}" \ --data-urlencode 'start=0' \ --data-urlencode "max_results=${COUNT}" \ --data-urlencode 'sortBy=submittedDate' \ --data-urlencode 'sortOrder=descending' ```