T09 · Insecure Skill Coding Practices
Error
- Location
scripts/small-cap-scanner.sh:10- Finding
Arbitrary Command Execution Through Unvalidated Arithmetic Input
- Content
View full analysis
- Remediation
View remediation
100 )); then echo "Error: pages must be an integer between 1 and 100" >&2 exit 2 fi ``` After validation, copy the value into an explicitly numeric variable and use that variable in the loop: ```bash PAGE_LIMIT=$((10#$PAGES)) for ((page=1; page<=PAGE_LIMIT; page++)); do # Scan page done ``` The `10#` prefix forces decimal interpretation and avoids accidental octal handling for values with leading zeroes. Apply equivalent allow-list validation to all externally supplied parameters: - Restrict `CHAIN` to the documented supported network identifiers. - Require `MAX_FDV` and `MIN_LIQUIDITY` to be bounded non-negative integers. - Require `MIN_BUY_RATIO` to match a narrowly defined decimal-number format. - Reject unexpected extra arguments. - Avoid placing untrusted text directly into Bash arithmetic expressions or dynamically evaluated `bc` programs. For additional hardening, enable strict shell behavior after argument validation: ```bash set -euo pipefail ``` Add regression tests that pass arithmetic metacharacters, array syntax, command substitutions, negative values, excessively large values, and non-numeric strings. The tests should verify that all such inputs are rejected before the loop condition is evaluated. ]]>