T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.sh:98- Finding
Unvalidated User Input Evaluated as bc Program Code
- Content
View full analysis
- Remediation
View remediation
0`. - Enforce `0 < price <= 1`. - Accept only `yes` or `no` for the result. 2. Limit input length and decimal precision to prevent resource exhaustion. 3. Avoid constructing executable calculator programs from raw user input. Parse values first and pass only normalized numeric representations to the calculation layer. 4. Use `printf` instead of `echo` for predictable data handling, although this alone does not resolve the injection vulnerability. 5. If `bc` remains necessary, reject any value that does not match a strict anchored pattern before invocation. For example: ```bash is_decimal() { [[ $1 =~ ^([0-9]+)([.][0-9]{1,2})?$ ]] } if ! is_decimal "$amount"; then printf '%s\n' "Invalid amount" >&2 exit 1 fi if ! is_decimal "$price"; then printf '%s\n' "Invalid price" >&2 exit 1 fi ``` 6. Perform explicit range checks after lexical validation and handle zero denominators safely. 7. Consider replacing `bc` with a programming environment or utility that accepts parsed numeric arguments as data rather than interpreting user-derived program text. 8. Add regression tests using multiline input, shell-escape characters, operators, very long numbers, zero, negative values, and malformed decimals. ]]>