T09 · Insecure Skill Coding Practices
Warning
- Location
lib/search.sh:235- Finding
Untrusted Search Queries Are Interpreted as grep Options and Regular Expressions
- Content
View full analysis
/dev/null) ``` The same unsafe query handling is used by count mode: ```bash local count=$(grep -c -i "$query" "$file" 2>/dev/null | head -1) ``` ```bash done < <(grep -i "$query" "$file" 2>/dev/null) ``` ### Technical Analysis The user-controlled `query` is passed directly to `grep` without an explicit `--` option terminator. Quoting prevents shell word splitting and command substitution, but it does not prevent `grep` from interpreting a value beginning with `-` as an option. The query is also interpreted as a basic regular expression even though the CLI documentation describes it as a keyword or phrase search and elsewhere characterizes matching as exact. Consequently: - Queries such as `--help`, `--version`, `-v`, or other implementation-supported options can alter `grep` behavior or prevent the intended file search. - Malformed regular expressions can cause search failures. - Computationally expensive expressions can consume excessive CPU when applied across many or large memory files. - Different `grep` implementations may expose different option-injection behavior, making results platform-dependent. - Search and count modes are both affected. This does not directly create shell command execution because the variable is quoted. The principal risks are argument injection, search-result manipulation, and resource exhaustion. ### Attack Path 1. An attacker supplies or induces an agent to use a search query beginning with a hyphen, such as `--help` or `-v`. 2. `search_memory` or `count_occurrences` passes the query directly to `grep`. 3. `grep` interprets the query as an option rather than the intended pattern. 4. Search ...[truncated 689 chars]- Remediation
View remediation