T09 · Insecure Skill Coding Practices
- Location
scripts/scan_ads.py:604- Finding
Unescaped Remote Filenames Allow Terminal Output Injection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_ads.py, lines 178–185 and 604
Vulnerability Type: Terminal escape-sequence injection through untrusted cloud metadata
Risk Level: MediumVulnerable Code
The page validator accepts a filename as long as it is a string, without rejecting or escaping terminal control characters:
python for entry in page["files"]: if (not isinstance(entry, dict) or not isinstance(entry.get("id"), str) or not entry["id"] or not isinstance(entry.get("name"), str) or entry.get("kind") not in ("drive#file", "drive#folder")): raise ScanError("目录条目缺少有效 ID/name/kind；扫描未完成")The resulting path is later written directly to the terminal:
python print(f" {it['size_h']:>10} {it['path']} —— {'；'.join(it['reasons'])}")Technical Analysis
During a live scan, file and folder names originate from PikPak CLI responses. A third party who can populate a scanned shared folder can therefore influence the
namefield. Althoughvalidate_page()verifies that this field is a string, it does not reject C0/C1 control characters or ANSI escape sequences.The filename is incorporated into
it['path']and printed verbatim in the human-readable report. When stdout is attached to an ANSI-capable terminal, escape sequences embedded in a filename may be interpreted as terminal instructions rather than displayed as inert text.JSON output is less exposed because
json.dumps()escapes JSON control characters. The vulnerable path is specifically the human-readable terminal display.Attack Path
- An attacker creates or contributes a file or folder in a PikPak share that the victim is authorized to scan.
- The attacker gives that object a filename containing terminal control sequences, such as cursor movement, screen clearing, forged status text, hidden text, or terminal-supported clipboard manipulation sequences.
- The victim ...[truncated 1253 chars]
- Remediation
View remediation
Remediation Suggestions
- Apply a dedicated terminal-safe formatter to every remote metadata value before human-readable output.
- Escape or visibly encode all C0 and C1 control characters, including ESC, carriage return, newline, backspace, and tab where layout preservation is unsafe.
- Consider rendering unsafe characters with explicit escaped notation such as
\x1b,\n, or Unicode escape forms. - Preserve raw metadata only in structured JSON output, where
json.dumps()provides appropriate JSON string escaping. - Apply the same encoding consistently to file names, folder names, paths, reasons, and any future remote metadata printed to a terminal.
- Add regression tests containing ANSI sequences, embedded newlines, carriage returns, and bidirectional or other display-control characters, and verify that the generated terminal output remains visually unambiguous.
- Keep approval decisions bound to immutable object IDs and the frozen report digest rather than relying only on visually rendered paths.