T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cleanup-inactive.sh:151- Finding
Independent regex-based JSON extraction can associate inactivity timestamps with the wrong devices
- Content
View full analysis
/dev/null | \ sed "s/.*\"${field}\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/" || true } ``` ```bash # scripts/cleanup-inactive.sh:151-155 tags=(); usernames=(); hostnames=(); types=(); update_times=() while IFS= read -r v; do tags+=("$v"); done < <(json_extract_all "$all_devices" "DeviceTag") while IFS= read -r v; do usernames+=("$v"); done < <(json_extract_all "$all_devices" "Username") while IFS= read -r v; do hostnames+=("$v"); done < <(json_extract_all "$all_devices" "Hostname") while IFS= read -r v; do types+=("$v"); done < <(json_extract_all "$all_devices" "DeviceType") while IFS= read -r v; do update_times+=("$v"); done < <(json_extract_all "$all_devices" "UpdateTime") ``` ```bash # scripts/cleanup-inactive.sh:160-182 for i in "${!tags[@]}"; do ut="${update_times[$i]:-}" is_inactive=false if [[ -z "$ut" ]]; then [[ -z "$cutoff_max_date" ]] && is_inactive=true else update_date="${ut:0:10}" if [[ -n "$cutoff_max_date" ]]; then [[ ! "$update_date" < "$cutoff_max_date" && "$update_date" < "$cutoff_date" ]] && is_inactive=true else [[ "$update_date" < "$cutoff_date" ]] && is_inactive=true fi fi if [[ "$is_inactive" == "true" ]]; then inactive_tags+=("${tags[$i]}") inactive_users+=("${usernames[$i]:-unknown}") inactive_hosts+=("${hostnames[$i]:-unknown}") inactive_types+=("${types[$i]:-unknown}") inactive_times+=("${ut:-never}") fi done ``` ### Technical Analysis The script does not parse each `Devices[]` JSON obje ...[truncated 2102 chars]- Remediation
View remediation