T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/configure.sh:30
- Finding
- Arbitrary Command Execution Through Unsafe Configuration Serialization## Vulnerability Details **File Location**: `scripts/configure.sh:30-100`; configuration is subsequently executed by `scripts/flomo_send.sh:14-19` **Vulnerability Type**: Shell command injection through sourced configuration **Risk Level**: High ### Vulnerable Code `scripts/configure.sh` accepts a webhook value without validating or escaping shell metacharacters: ```bash read -rp "Webhook token (or full URL): " WEBHOOK_INPUT if [ -z "$WEBHOOK_INPUT" ]; then echo "⚠️ No webhook provided. You can configure it later by running this script again." exit 0 fi # Detect if user pasted full URL or just token if echo "$WEBHOOK_INPUT" | grep -q "^https://flomoapp.com/iwh/"; then # Full URL provided WEBHOOK_URL="$WEBHOOK_INPUT" WEBHOOK_TOKEN=$(echo "$WEBHOOK_URL" | sed 's|https://flomoapp.com/iwh/||') else # Just token provided WEBHOOK_TOKEN="$WEBHOOK_INPUT" WEBHOOK_URL="https://flomoapp.com/iwh/$WEBHOOK_TOKEN" fi ``` The unescaped value is written as executable shell syntax to either a shell startup file: ```bash echo "" >> "$SHELL_CONFIG" echo "# Flomo Skill Configuration" >> "$SHELL_CONFIG" echo "export FLOMO_WEBHOOK_TOKEN=$WEBHOOK_TOKEN" >> "$SHELL_CONFIG" ``` Or to the local `.env` file: ```bash ENV_FILE="$(dirname "$0")/../.env" echo "# Flomo Skill Configuration" > "$ENV_FILE" echo "FLOMO_WEBHOOK_TOKEN=$WEBHOOK_TOKEN" >> "$ENV_FILE" echo "# FLOMO_WEBHOOK_URL=$WEBHOOK_URL" >> "$ENV_FILE" chmod 600 "$ENV_FILE" ``` `scripts/flomo_send.sh` later executes the generated `.env` file as shell code: ```bash ENV_FILE="$(dirname "$0")/../.env" if [ -f "$ENV_FILE" ]; then set -o allexport # shellcheck disable=SC1090 source "$ENV_FILE" set +o allexport fi ``` ### Technical Analysis The webhook token crosses a trust boundary from interactive user input into a shell program. It is serialized by concatenating it directly into an ...[truncated 2187 chars]
- Remediation
- ## Remediation Suggestions 1. Validate token-only input against the exact character set and length allowed by flomo. Reject whitespace, control characters, shell metacharacters, and unexpected URL syntax. 2. Prefer accepting only a token and constructing the fixed webhook URL internally. Do not accept arbitrary shell expressions or unrestricted URLs. 3. Do not load data files with `source`. Store configuration in a non-executable format, such as JSON, and parse the required field with a data parser. 4. If shell-compatible output is unavoidable, serialize values safely with `printf '%q'` rather than string concatenation: ```bash { printf '%s\n' '# Flomo Skill Configuration' printf 'FLOMO_WEBHOOK_TOKEN=%q\n' "$WEBHOOK_TOKEN" } > "$ENV_FILE" chmod 600 "$ENV_FILE" ``` 5. Avoid writing credentials to shell startup files. Use the permission-restricted, non-executable application configuration file instead. 6. Write configuration atomically using a securely created temporary file, set restrictive permissions before adding the secret, and then rename it into place. 7. Add regression tests using values containing semicolons, command substitutions, quotes, backticks, spaces, and redirection operators. All malformed values should be rejected without executing any command.