T09 · Insecure Skill Coding Practices
- Location
eslint-config-generator.sh:2- Finding
Unvalidated Preset Injection and Unconditional ESLint Configuration Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
eslint-config-generator.sh, lines 2–9
Vulnerability Type: Unvalidated input injection into generated JSON and unsafe file overwrite
Risk Level: MediumVulnerable Code
bash PRESET="${1:-airbnb}" cat > .eslintrc.json << JSON { "extends": ["$PRESET"], "rules": {} } JSONTechnical Analysis
The script accepts its first positional argument without validating it against the documented presets or escaping it for use as a JSON string. Because
PRESETis expanded directly inside a heredoc, quotation marks, backslashes, and newline characters can modify the structure of the resulting.eslintrc.jsonfile.This is not direct shell-command injection: shell syntax introduced through the value of
PRESETis not reparsed as executable shell code during parameter expansion. However, an attacker-controlled value can corrupt the JSON or inject additional ESLint configuration properties.ESLint configurations can reference executable JavaScript configuration files and plugins. A maliciously generated
extendsvalue, or injected configuration property, could therefore cause a subsequent ESLint invocation to load attacker-controlled local code. Exploitation requires the referenced malicious component to be available in the project or resolvable through the environment.In addition,
cat > .eslintrc.jsonunconditionally truncates any existing configuration without confirmation or backup. Running the script in an established project can therefore destroy existing configuration and replace it with attacker-influenced content.Attack Path
- An attacker persuades a developer or automation process to invoke the generator with a crafted preset argument.
- The script interpolates the argument directly into
.eslintrc.jsonwithout JSON escaping or preset validation. - The redirection silently replaces any existing
.eslintrc.json. - The crafted value ...[truncated 1049 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse the documented command-line options explicitly instead of treating the first positional argument as an unrestricted preset.
- Allowlist supported preset names, such as
airbnb,standard,prettier,react,vue, andtypescript, and reject all other values. - Generate the configuration through a JSON-aware serializer rather than interpolating input into a heredoc. This ensures that quotation marks, backslashes, and control characters are escaped correctly.
- Reject control characters and unexpected path-like values even if additional custom presets are supported.
- Check whether
.eslintrc.jsonalready exists and refuse to overwrite it by default. - Require an explicit option such as
--forcebefore replacing an existing file, and consider creating a backup or writing to a temporary file followed by an atomic rename. - Return a nonzero exit status with a clear error message when validation fails or the destination cannot be written.