T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gather.sh:114- Finding
Python Code Injection Through Configurable Session Directory
- Content
View full analysis
/dev/null || echo "") ``` The resulting configuration value is subsequently inserted directly into another Python program: ```bash if [ -n "$SESSIONS_DIR" ] && [ -d "$SESSIONS_DIR" ]; then echo "## SESSIONS" echo "" python3 -c " import os, json, glob, sys sdir = '$SESSIONS_DIR' start, end = '$START_DATE', '$DATE' found = 0 for f in sorted(glob.glob(os.path.join(sdir, '*.jsonl'))): if f.endswith('.lock'): continue try: with open(f) as fh: d = json.loads(fh.readline()) ts = d.get('timestamp','')[:10] if ts >= start and ts <= end: lines = sum(1 for _ in open(f)) sid = os.path.basename(f).replace('.jsonl','') print(f'- {sid[:12]}... | {ts} | {lines} lines') found += 1 except: pass if not found: print('(no sessions found for this period)') " 2>/dev/null || echo "(python3 not available — skipping sessions)" fi ``` ### Technical Analysis The `sessionsDir` property originates in the editable `config.json` file. Although the value is initially parsed as JSON, the shell script later interpolates it into a single-quoted Python string inside a `python3 -c` command: ```python sdir = '$SESSIONS_DIR' ``` JSON parsing does not make a value safe for insertion into Python source code. A value containing a single quote, Python statement separators, and a comment marker can terminate the intended string and append arbitrary Python statements. Execution is subject to the preceding `[ -d "$SESSIONS_DIR" ]` check. Therefore, exploitation requires the attacker to supply a crafted configuration value ...[truncated 1641 chars]- Remediation
View remediation