T09 · Insecure Skill Coding Practices
Warning
- Location
- daily-brief.sh:22
- Finding
- Untrusted Remote Content Rendered with Escape Interpretation over an Insecure Connection<![CDATA[ ## Vulnerability Details **File Location**: `daily-brief.sh`, lines 22–46 **Vulnerability Type**: Remote terminal-output injection and insecure transport **Risk Level**: Medium ### Complete Code Snippet ```bash # 获取天气 get_weather() { echo -e "${PURPLE}🌤️ 天气${NC}" local weather=$(curl -s "wttr.in/$CITY?format=3" 2>/dev/null) if [ $? -eq 0 ] && [ -n "$weather" ]; then echo -e " $weather" else echo -e " 获取失败，请检查网络" fi echo "" } # 获取百度热搜 get_news() { echo -e "${BLUE}🔥 百度热搜${NC}" local hot_data=$(curl -s "https://top.baidu.com/api/board?platform=wise&tab=realtime" 2>/dev/null) if [ $? -eq 0 ] && [ -n "$hot_data" ]; then # 解析JSON并显示前TOP_N条 local count=0 while IFS= read -r word; do if [ $count -lt $TOP_N ]; then count=$((count + 1)) echo -e " ${YELLOW}$count.${NC} $word" fi done < <(echo "$hot_data" | grep -o '"word":"[^"]*"' | sed 's/"word":"//;s/"$//') ``` ### Technical Analysis The weather request specifies `wttr.in` without an explicit URL scheme. Curl consequently initiates the request using HTTP unless transport behavior is changed externally or by a redirect. The initial plaintext request can be observed and modified by a network-positioned attacker. Both weather data and extracted news text are subsequently passed to `echo -e`. The `-e` option interprets backslash escape notation contained in the supplied text. An upstream service, compromised endpoint, or network-positioned attacker can therefore return text containing sequences such as `\e[...]`, which Bash converts into terminal control characters when displaying the response. The news endpoint uses HTTPS, reducing network interception risk, but its content remains externally controlled and is still passed through `echo -e`. The regular-expression-based JSON extraction does not remove backslashes or other dangerous terminal-oriented ...[truncated 1675 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS and reject protocol downgrade or unexpected protocols: ```bash weather=$(curl --fail --silent --show-error \ --proto '=https' --proto-redir '=https' \ "https://wttr.in/${CITY}?format=3") ``` 2. Do not use `echo -e` for externally sourced content. Print it as inert data: ```bash printf ' %s\n' "$weather" printf ' %s\n' "$word" ``` 3. Remove unsafe control characters before rendering remote text. If line breaks are unnecessary, restrict output to printable characters and explicitly approved Unicode characters. 4. Parse the Baidu response with a real JSON parser, such as `jq`, rather than `grep` and `sed`. Parsing alone does not make terminal output safe, so sanitized output must still be printed with `printf '%s'`. 5. Capture and test Curl's status directly instead of inspecting `$?` after a command substitution declaration. For example: ```bash if weather=$(curl --fail --silent --show-error \ --proto '=https' --proto-redir '=https' \ "https://wttr.in/${CITY}?format=3"); then printf ' %s\n' "$weather" else printf ' Weather retrieval failed; check the network connection.\n' fi ``` 6. Apply connection timeouts and response-size limits to reduce availability risks from stalled or excessively large responses. ]]>