T09 · Insecure Skill Coding Practices
Error
- Location
scripts/control.js:15- Finding
Shell Command Injection Through User-Controlled Browser URLs
- Content
View full analysis
`--${k}="${v}"`) .join(' ')}`; return execSync(cmd, { encoding: 'utf8' }); } catch (error) { console.error('Browser action failed:', error.message); throw error; } } ``` The `play` function passes a user-controlled URL to this command-construction function: ```js async function play(query) { ensureBrowser(); if (query.includes('youtube.com') || query.includes('youtu.be')) { // Direct URL browserAction('open', { targetUrl: query }); } else { // Search and play first result const url = `${YOUTUBE_MUSIC_URL}/search?q=${encodeURIComponent(query + ' song')}`; browserAction('open', { targetUrl: url }); } console.log(`Playing: ${query}`); } ``` ### Technical Analysis `browserAction` constructs a shell command by interpolating parameter names and values into a string passed to `child_process.execSync`. Double quotes around a parameter do not provide safe shell escaping because a value containing a double quote can terminate the quoted argument. Shell metacharacters placed after that quote can then be interpreted by the shell. The direct-URL branch of `play` passes `query` without URL validation or shell escaping. The only check is whether the string contains `youtube.com` or `youtu.be`, which does not prevent the string from also containing quote characters or shell syntax. Although callers currently supply fixed action names and parameter names, the user-controlled `targetUrl` value alone is sufficient to reach the command-injection sink. ### Attack Path 1. A ...[truncated 1265 chars]- Remediation
View remediation