T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/full-audit.sh:199
- Finding
- Arbitrary JavaScript Execution Through Output Directory Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/full-audit.sh:199-225` and `scripts/full-audit.sh:248-257` **Vulnerability Type**: User-controlled data interpolated into executable JavaScript source **Risk Level**: High ### Vulnerable Code ```bash local report="$OUTPUT_DIR/full-audit-report-$TIMESTAMP.md" if [ -f "$OUTPUT_DIR/axe-full-$TIMESTAMP.json" ]; then echo "### Axe-core Bulguları" >> "$report" echo "" >> "$report" node -e " const fs = require('fs'); try { const data = JSON.parse(fs.readFileSync('$OUTPUT_DIR/axe-full-$TIMESTAMP.json', 'utf8')); const violations = data.violations || []; const incomplete = data.incomplete || []; const passes = data.passes || []; console.log('| Kategori | Sayı |'); console.log('|----------|------|'); console.log('| İhlaller | ' + violations.length + ' |'); console.log('| İncelenecek | ' + incomplete.length + ' |'); console.log('| Geçen | ' + passes.length + ' |'); console.log(''); if (violations.length > 0) { console.log('### İhlal Detayları'); console.log(''); violations.forEach(v => { console.log('#### ' + v.id); console.log(''); console.log('- **Etki:** ' + v.impact); console.log('- **Açıklama:** ' + v.description); console.log('- **Yardım:** ' + v.helpUrl); console.log('- **Etkilenen Element:** ' + v.nodes.length); console.log(''); }); } } catch (e) { console.log('Sonuçlar işlenemedi'); } " >> "$report" 2>/dev/null || echo "Sonuçlar işlenemedi" >> "$report" fi ``` The same construction is used for the Lighthouse report: ```bash node -e " const fs = require('fs'); try ...[truncated 1668 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never interpolate user-controlled paths into source passed to `node -e`. - Pass paths as positional arguments: ```bash node - "$OUTPUT_DIR/axe-full-$TIMESTAMP.json" <<'NODE' const fs = require('fs'); const inputPath = process.argv[2]; const data = JSON.parse(fs.readFileSync(inputPath, 'utf8')); NODE ``` - Alternatively, move report processing into a dedicated JavaScript file and provide the path through `process.argv`. - Validate and canonicalize output directories. - Reject paths containing control characters and ensure the resolved path is inside an explicitly approved report root. - Run audit tooling under a minimally privileged account. ]]>