T09 · Insecure Skill Coding Practices
Error
- Location
scripts/common.sh:216- Finding
Unchecked arguments allow persistent command injection through generated service definitions
- Content
View full analysis
"$CONFIG_DIR/openclaw.json.tmp" && mv "$CONFIG_DIR/openclaw.json.tmp" "$CONFIG_DIR/openclaw.json" echo "✅ 端口已设置为：$PORT" fi if create_service_file "$INSTANCE_KEY" "$CONFIG_DIR" "$PORT" "$SERVICE_FILE"; then echo "✅ 服务文件已创建：$SERVICE_FILE" else echo "ℹ️ 当前系统仅创建配置目录，服务请手动启动" fi if enable_service "$INSTANCE_KEY" "$SERVICE_FILE"; then ``` From `scripts/gateway-set-port.sh`: ```bash INSTANCE="$1" NEW_PORT="$2" ``` ```bash jq ".gateway.port = $NEW_PORT" "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" echo "✅ 配置文件已更新：$CONFIG_FILE" if [ -d "$CONFIG_DIR/.openclaw" ]; then cp "$CONFIG_FILE" "$CONFIG_DIR/.openclaw/openclaw.json" echo "✅ 嵌套配置已同步" fi if [ -n "$SERVICE_FILE" ] && [ -f "$SERVICE_FILE" ]; then create_service_file "$INSTANCE_KEY" "$CONFIG_DIR" "$NEW_PORT" "$SERVICE_FILE" echo "✅ 服务文件已更新：$SERVICE_FILE" else echo "⚠️ 未找到服务文件，将仅更新配置" fi ``` From the macOS service template in `scripts/common.sh`: ```bash require('child_process').execSync('openclaw gateway --port $port', {cwd: '$config_dir', stdio: 'inherit', env: {...process.env, OPENCLAW_HOME: '$config_dir'}}) ``` From the Linux systemd service template in `scripts/common.sh`: ```bash [Service] Type=simple WorkingDirectory=$config_dir Environment=OPENCLAW_HOME=$config_dir Environment=OPENCLAW_GATEWAY_PORT=$port ExecStart=/bin/sh -lc 'openclaw gateway --port $port' Restart=always RestartSec=2 StandardOutput=append:$config_dir/logs/ ...[truncated 3013 chars]- Remediation
View remediation
&2 exit 1 ;; esac if [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then echo "Invalid port: expected a value from 1 to 65535" >&2 exit 1 fi ``` 2. Restrict instance identifiers to a conservative format, such as: ```bash case "$INSTANCE_NAME" in ''|*[!A-Za-z0-9_-]*) echo "Invalid instance name" >&2 exit 1 ;; esac ``` Also impose a reasonable maximum length. 3. Do not use `/bin/sh -lc` or JavaScript `execSync` with a constructed command string. Launch the executable with fixed, separately encoded arguments. On macOS, use `ProgramArguments` entries for the executable and each argument rather than executing a shell through Node. 4. Use a fixed, absolute path to the trusted `openclaw` executable after verifying it is a regular executable owned by an expected user or package source. 5. Escape all values for their destination format. XML escaping, systemd argument encoding, shell quoting, and JavaScript string escaping are different operations and must not be treated as interchangeable. 6. Abort immediately when `jq`, service generation, or validation fails. Generate a temporary file, validate it, set restrictive permissions, and atomically move it into place only after all checks succeed. 7. Validate generated LaunchAgent files with `plutil` and generated systemd units with an appropriate unit verifier before enabling them. ]]>