T09 · Insecure Skill Coding Practices
- Location
scripts/configure.sh:82- Finding
Arbitrary Command Execution Through Unsafely Persisted Webhook Input
- Content
View full analysis
Vulnerability Details
File Location:
scripts/configure.sh:33-50,scripts/configure.sh:76-98, andscripts/flomo_send.sh:13-19
Vulnerability Type: Shell command injection through executable configuration files
Risk Level: HighThe configuration script accepts webhook input and writes it directly into either a local
.envfile or a shell startup file without validation or shell-safe serialization. The send script subsequently executes the.envfile usingsource.Vulnerable Code
User-controlled webhook input is collected without restricting shell metacharacters:
bash read -rp "Webhook token (or full URL): " WEBHOOK_INPUT if [ -z "$WEBHOOK_INPUT" ]; then echo "⚠️ No webhook provided. You can configure it later by running this script again." exit 0 fi # Detect if user pasted full URL or just token if echo "$WEBHOOK_INPUT" | grep -q "^https://flomoapp.com/iwh/"; then # Full URL provided WEBHOOK_URL="$WEBHOOK_INPUT" WEBHOOK_TOKEN=$(echo "$WEBHOOK_URL" | sed 's|https://flomoapp.com/iwh/||') echo "" echo "✅ Webhook URL configured" else # Just token provided WEBHOOK_TOKEN="$WEBHOOK_INPUT" WEBHOOK_URL="https://flomoapp.com/iwh/$WEBHOOK_TOKEN" echo "" echo "✅ Webhook token configured" fiThe resulting value is embedded directly into executable shell syntax:
bash case "$CONFIG_CHOICE" in 2) # Save to shell config if [ -n "$SHELL_CONFIG" ]; then echo "" >> "$SHELL_CONFIG" echo "# Flomo Skill Configuration" >> "$SHELL_CONFIG" echo "export FLOMO_WEBHOOK_TOKEN=$WEBHOOK_TOKEN" >> "$SHELL_CONFIG" echo "" echo "✅ Configuration saved to: $SHELL_CONFIG" echo " Please run: source $SHELL_CONFIG" else echo "⚠️ Could not detect shell config file." echo " Please manually add to your s ...[truncated 3689 chars]- Remediation
View remediation
Remediation Suggestions
-
Apply strict token validation. If the user provides only a webhook token, permit only the characters required by the service. For example:
bash if [[ ! "$WEBHOOK_INPUT" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Error: Invalid webhook token format" >&2 exit 1 fiThe precise allowlist should be aligned with flomo's documented token format.
-
Validate full URLs structurally. Require:
- The
httpsscheme. - The exact expected flomo hostname.
- The expected
/iwh/path. - A token segment that satisfies the strict token allowlist.
- No username, password, fragment, unexpected port, query parameters, whitespace, control characters, or shell metacharacters.
- The
-
Do not source
.envas executable code. Treat the configuration as data and parse only explicitly supported keys. A safer design is to store only the raw token in a dedicated file and read it with a non-evaluating operation:bash IFS= read -r FLOMO_WEBHOOK_TOKEN < "$TOKEN_FILE" export FLOMO_WEBHOOK_TOKEN -
Avoid writing secrets into shell startup files. Prefer a dedicated configuration file with mode
600. Shell startup files increase both command-execution exposure and persistence risk. -
If shell output is retained, serialize defensively. Validate the value first and then use a shell-aware escaping mechanism such as
printf '%q'rather than string interpolation:bash printf 'export FLOMO_WEBHOOK_TOKEN=%q\n' "$WEBHOOK_TOKEN" >> "$SHELL_CONFIG"Escaping should be defense in depth and must not replace strict validation.
-
Reject dangerous input explicitly. Reject whitespace, control characters, command substitutions, backticks, quotes, semicolons, redirection operators, backslashes, and line breaks.
-
Add regression tests. Test values containing command substitutions, semicolons, quotes, backticks, space ...[truncated 186 chars]
-