T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/push_api_to_frontend.py:29
- Finding
- Latent Arbitrary Command Execution Through an Unsafe Shell Helper<![CDATA[ ## Vulnerability Details **File Location**: `scripts/push_api_to_frontend.py`, lines 29–45 **Vulnerability Type**: Shell command injection primitive **Risk Level**: Medium ### Vulnerable Code ```python def run_command(cmd, capture=True): """执行 shell 命令""" import subprocess try: result = subprocess.run( cmd, shell=True, capture_output=capture, text=True, timeout=60 ) return result.returncode, result.stdout, result.stderr except subprocess.TimeoutExpired: return -1, "", "Command timed out" except Exception as e: return -1, "", str(e) ``` ### Technical Analysis The helper passes an arbitrary string directly to `subprocess.run()` with `shell=True`. Consequently, the operating system shell interprets separators, substitutions, redirections, and other shell syntax contained in `cmd`. If an attacker-controlled value ever reaches this function, payloads containing shell metacharacters could execute additional commands. The helper is not called by the current project, so there is no presently reachable command-injection path through the documented workflow. Nevertheless, it is an unnecessary high-risk primitive that exceeds the capabilities required to upload API definitions and creates a latent vulnerability if reused during future maintenance. ### Attack Path The prerequisite for exploitation is that this currently unused helper becomes connected to an input source: 1. A future code change passes a command containing a filename, API field, interactive value, or other attacker-controlled text to `run_command()`. 2. The attacker supplies shell syntax in that value. 3. `subprocess.run()` invokes the operating system shell because `shell=True`. 4. The shell interprets the injected syntax as commands rather than treating it as a literal argument. 5. Those commands execute with the same operating-system identity and permissions as the S ...[truncated 634 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `run_command()` because the current API-upload workflow does not use or require local command execution. 2. If process execution is later required, provide the executable and arguments as a fixed list and retain the default `shell=False` behavior: ```python subprocess.run( ["fixed-program", "--fixed-option", validated_value], shell=False, capture_output=True, text=True, timeout=60, check=False, ) ``` 3. Allowlist executable names and accepted argument formats. 4. Do not construct command strings by concatenating or interpolating user-controlled values. 5. Run any required child process with minimal filesystem and network privileges. 6. Add a static-analysis rule that rejects `shell=True` unless a reviewed exception is documented. ]]>