T09 · Insecure Skill Coding Practices
Error
- Location
scripts/digest.sh:584- Finding
Arbitrary Python Code Execution Through Output-Path Interpolation
- Content
View full analysis
/dev/null } ``` `OUTPUT_DIR` can be supplied through the command line: ```bash --output) OUTPUT_DIR="$2" shift 2 ;; ``` ### Technical Analysis The `--output` argument is controlled by the caller and becomes part of `md_file` and `html_file`. These paths are then interpolated directly into the source text passed to `python3 -c`. Shell quoting around `"${OUTPUT_DIR}"` does not protect the Python source. A path containing a single quote and a valid Python expression can terminate or alter the Python string literal. When HTML generation runs, Python interprets the resulting value as source code rather than as data. For example, a malicious output path can alter an expression such as: ```python with open('${md_file}', 'r') as f: ``` so that a Python function call executes while Python evaluates the argument passed to `open()`. Execution can occur before the subsequent file operation fails. This is a source-code injection vulnerability. It is distinct from ordinary shell command injection because the affected interpreter is Python. ### Attack Path 1. An attacker gains the ability to influence arguments used to invoke `digest.sh`, including through an automation wrapper or scheduled invocation. 2. The atta ...[truncated 1119 chars]- Remediation
View remediation
/dev/null`; return a controlled diagnostic without exposing secrets. ]]>