T09 · Insecure Skill Coding Practices
Error
- Location
github-readme-generator.sh:180- Finding
Arbitrary Command Execution Through Sed Script Injection
- Content
View full analysis
/dev/null || echo "") if [ -n "$GIT_NAME" ]; then AUTHOR_NAME="$GIT_NAME" fi fi ``` ```bash # Replace placeholders CONTENT=$(echo "$TEMPLATE_CONTENT" | sed "s/{NAME}/$NAME/g") CONTENT=$(echo "$CONTENT" | sed "s/{NAME_KEBAB}/$NAME_KEBAB/g") CONTENT=$(echo "$CONTENT" | sed "s/{NAME_CAMEL}/$NAME_CAMEL/g") CONTENT=$(echo "$CONTENT" | sed "s/{DESCRIPTION}/$DESCRIPTION/g") CONTENT=$(echo "$CONTENT" | sed "s/{AUTHOR_NAME}/$AUTHOR_NAME/g") ``` ### Technical Analysis The script embeds user-controlled values directly into double-quoted `sed` programs. The affected values include the project name, description, transformed project names, the `AUTHOR_NAME` environment variable, and the repository-local Git username. Shell quoting does not make these values safe for use as part of a `sed` program. Characters meaningful to `sed`, including the selected delimiter, backslashes, ampersands, and newline characters, are not escaped. A value containing a newline can terminate the intended substitution command and introduce additional `sed` commands. On GNU `sed`, an injected `e` command executes a command through the system shell. Consequently, a malicious multiline value can convert placeholder processing into arbitrary operating-system command execution. The repository-local value obtained from `git config user.name` must also be considered untrusted because repository configuration or a prepared working directory can influence it. The modern template contains `{ AUTHOR_NAME }` rather than `{AUTHOR_NAME}`, but this mismatch does not reliably prevent exploitation. Inj ...[truncated 1566 chars]- Remediation
View remediation