T09 · Insecure Skill Coding Practices
Error
- Location
etf-assistant.sh:232- Finding
Arbitrary Command Execution Through Bash Arithmetic Injection
- Content
View full analysis
- Remediation
View remediation
&2 return 1 fi if ! [[ "$years" =~ ^[1-9][0-9]*$ ]]; then echo "Years must be a positive integer." >&2 return 1 fi if (( amount > 100000000 || years > 100 )); then echo "Amount or duration exceeds the supported range." >&2 return 1 fi ``` After validation, force base-10 interpretation to prevent leading-zero values from being treated as octal: ```bash local amount_num=$((10#$amount)) local years_num=$((10#$years)) local months=$((years_num * 12)) local total_invest=$((amount_num * months)) ``` Construct the `bc` input exclusively from these validated numeric variables: ```bash local future_value future_value=$(printf '%s\n' \ "scale=2; $amount_num * ((1 + $monthly_return)^$months - 1) / $monthly_return" | bc) ``` Additional hardening should include: - Reject signs, whitespace, decimal points, variable names, brackets, parentheses, and shell metacharacters unless explicitly required. - Check for integer overflow before multiplication. - Use `local variable; variable=$(...)` rather than combining declaration and command substitution, so command failures are not masked by `local`. - Handle `bc` failures explicitly and return a nonzero status. - Run the Skill with a restricted account and minimal filesystem, environment, and network access. ]]>