T09 · Insecure Skill Coding Practices
- Location
scripts/render_x_longshot.js:126- Finding
Arbitrary Python Code Execution Through Unsafely Interpolated Output Paths
- Content
View full analysis
Vulnerability Details
File Location:
scripts/render_x_longshot.js, lines 126-150
Vulnerability Type: Python source-code injection
Risk Level: HighVulnerable Code
javascript const py = ` from PIL import Image raw = Image.open(r'''${rawPng}''').convert('RGB') top = Image.open(r'''${topPng}''').convert('RGB') out = raw.copy() crop_h = min(${args.topFixPx}, top.size[1], out.size[1]) out.paste(top.crop((0,0,top.size[0],crop_h)), (0,0)) out.save(r'''${args.outPng}''') print(r'''${args.outPng}''') `; runPython(py); if (!args.noPdf) { const pyPdf = ` from PIL import Image img = Image.open(r'''${args.outPng}''').convert('RGB') img.save(r'''${args.outPdf}''', 'PDF', resolution=144.0) print(r'''${args.outPdf}''') `; runPython(pyPdf); }The generated programs are executed by the following helper:
javascript function runPython(code) { const r = spawnSync('python3', ['-c', code], { encoding: 'utf8' }); if (r.status !== 0) { throw new Error(r.stderr || r.stdout || 'python3 failed'); } return r.stdout.trim(); }Technical Analysis
The values supplied through
--out-pngand--out-pdfare interpolated directly into Python source code enclosed by raw triple-quoted string literals. They are then passed topython3 -c.Although
spawnSyncis invoked without a shell, this only prevents shell metacharacter expansion. It does not prevent injection into the Python program itself. A path containing a terminating'''sequence can close the intended string literal and append arbitrary Python statements.The PDF path is a direct exploitation point because the attacker can terminate the path passed to
img.save, append a Python expression such as anosorsubprocessinvocation, and comment out the remaining generated source. The earlier image processing succeeds using a legitimate PNG path before the malicious PDF- ...[truncated 1591 chars]- Remediation
View remediation
Remediation Suggestions
Do not embed caller-controlled values in executable Python source.
-
Move the Pillow operations into a fixed Python helper script and pass all paths as ordinary command-line arguments:
javascript spawnSync('python3', [ helperScript, '--raw', rawPng, '--top', topPng, '--output', args.outPng, '--top-fix-px', String(args.topFixPx) ]);The helper should retrieve these values through
argparseorsys.argv, where they remain data rather than Python syntax. -
Alternatively, send a JSON object to a fixed Python program through standard input and parse it with
json.load(sys.stdin). -
Validate and normalize output paths before use. Require a conservative filename policy and constrain resolved paths to an approved output directory.
-
Reject null bytes, control characters, newline characters, and unexpected path components. This validation should be defense in depth rather than the primary injection mitigation.
-
Add regression tests using filenames containing quotes, triple quotes, backslashes, newlines, Unicode characters, and Python metacharacters. Verify that these values are either safely handled as filenames or explicitly rejected and never interpreted as code.
-