T09 · Insecure Skill Coding Practices
Warning
- Location
daily-brief.sh:22- Finding
Untrusted Remote Content Rendered with Escape Interpretation over an Insecure Connection
- Content
View full analysis
/dev/null) if [ $? -eq 0 ] && [ -n "$weather" ]; then echo -e " $weather" else echo -e " 获取失败，请检查网络" fi echo "" } # 获取百度热搜 get_news() { echo -e "${BLUE}🔥 百度热搜${NC}" local hot_data=$(curl -s "https://top.baidu.com/api/board?platform=wise&tab=realtime" 2>/dev/null) if [ $? -eq 0 ] && [ -n "$hot_data" ]; then # 解析JSON并显示前TOP_N条 local count=0 while IFS= read -r word; do if [ $count -lt $TOP_N ]; then count=$((count + 1)) echo -e " ${YELLOW}$count.${NC} $word" fi done < <(echo "$hot_data" | grep -o '"word":"[^"]*"' | sed 's/"word":"//;s/"$//') ``` ### Technical Analysis The weather request specifies `wttr.in` without an explicit URL scheme. Curl consequently initiates the request using HTTP unless transport behavior is changed externally or by a redirect. The initial plaintext request can be observed and modified by a network-positioned attacker. Both weather data and extracted news text are subsequently passed to `echo -e`. The `-e` option interprets backslash escape notation contained in the supplied text. An upstream service, compromised endpoint, or network-positioned attacker can therefore return text containing sequences such as `\e[...]`, which Bash converts into terminal control characters when displaying the response. The news endpoint uses HTTPS, reducing network interception risk, but its content remains externally controlled and is still passed through `echo -e`. The regular-expression-based JSON extraction does not remove backslashes or other dangerous terminal-oriented ...[truncated 1675 chars]- Remediation
View remediation