T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/uf2.sh:47
- Finding
- Unescaped User Input Allows JSON Request-Body Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/uf2.sh`, lines 47-57 **Vulnerability Type**: Improper JSON encoding of untrusted command-line arguments **Risk Level**: Medium ### Vulnerable Code ```bash local body="{\"url\":\"$url\"" [[ -n "$slug" ]] && body="$body,\"slug\":\"$slug\"" [[ -n "$title" ]] && body="$body,\"title\":\"$title\"" body="$body}" curl -s -X POST "$API_BASE/links" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d "$body" ``` ### Technical Analysis The `url`, `slug`, and `title` arguments are inserted directly into a JSON string without JSON escaping or structural validation. Characters with special meaning in JSON, including quotation marks, backslashes, and control characters, can terminate a value, corrupt the document, or introduce additional properties. For example, a crafted title resembling the following can alter the generated JSON structure: ```text x","url":"https://attacker.example/ ``` The exact handling of duplicate properties depends on the remote JSON parser, so replacement of an earlier property is not guaranteed. Nevertheless, the wrapper does not preserve the intended boundary between user data and JSON syntax. The shell expansions are quoted, so this flaw does not directly provide local shell-command execution. The vulnerable boundary is the authenticated JSON request sent to the uf2.net API. ### Attack Path 1. An attacker supplies or influences a URL, slug, or title passed to `uf2.sh create`. 2. The attacker includes JSON metacharacters in that value. 3. The script concatenates the value into `body` without escaping it. 4. The script authenticates the request with the user's `UF2_API_KEY`. 5. The remote service receives malformed or structurally modified JSON. 6. Depending on parser behavior and server-side validation, the request can fail or create a link with unintended URL, slug, title, or other accepted properties. ### Impact Assessment Exploita ...[truncated 388 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Construct request bodies with a JSON-aware encoder rather than string concatenation. For example, use `jq`: ```bash local body if [[ -n "$slug" && -n "$title" ]]; then body=$(jq -n \ --arg url "$url" \ --arg slug "$slug" \ --arg title "$title" \ '{url: $url, slug: $slug, title: $title}') elif [[ -n "$slug" ]]; then body=$(jq -n \ --arg url "$url" \ --arg slug "$slug" \ '{url: $url, slug: $slug}') elif [[ -n "$title" ]]; then body=$(jq -n \ --arg url "$url" \ --arg title "$title" \ '{url: $url, title: $title}') else body=$(jq -n --arg url "$url" '{url: $url}') fi ``` Additional hardening should include: - Validate that the URL uses an explicitly permitted scheme such as HTTPS or HTTP. - Enforce the documented URL length limit before sending the request. - Validate custom slugs against the documented character and length constraints. - Reject control characters in arguments where they are not needed. - Add tests covering quotation marks, backslashes, newlines, Unicode, and attempted property injection. - Use `curl --fail-with-body` so HTTP error responses cause the command to fail under `set -e`. ]]>