T09 · Insecure Skill Coding Practices
Error
- Location
deploy.sh:6- Finding
Unvalidated Arguments Permit Docker Compose and JSON Configuration Injection
- Content
View full analysis
docker-compose.yml << EOF version: '3.8' services: ohif: image: ohif/viewer:latest ports: - "${PORT}:3000" environment: - APP_CONFIG=/usr/local/share/ohif/static/hosting.json volumes: - ./config:/usr/local/share/ohif/static restart: unless-stopped nginx: image: nginx:alpine ports: - "80:80" - "443:443" volumes: - ./nginx.conf:/etc/nginx/nginx.conf:ro depends_on: - ohif restart: unless-stopped EOF mkdir -p config cat > config/hosting.json << EOF { "defaultDataSourceName": "${DATA_SOURCE}", "dataSources": [ { "namespace": "@ohif/extension-default.dataSourcesModule.dicomweb", "sourceName": "${DATA_SOURCE}", "configuration": { "wadoUriRoot": "https://www.allhealthai.com/HealthRecordCenter", "qidoRoot": "https://www.allhealthai.com/HealthRecordCenter", "wadoRoot": "https://scnc.allhealthai.com:16010/HealthRecordCenter", "imageRendering": "wadors", "thumbnailRendering": "wadors", "enableStudyLazyLoad": true } } ] } EOF ``` ### Technical Analysis The script accepts its port and data-source values directly from positional arguments and inserts them into unquoted heredocs without validation or context-aware encoding. A malicious `PORT` value can contain quotation marks, line breaks, and YAML directives that escape the expected `ports` scalar and modify the generated Compose document. Depending on the injected structure, an attacker could add services, change images, configure privileged execution, expose additional ports, or create sensitive host bind mounts. Similarly, a malicious `DATA_SOURCE` value cont ...[truncated 2265 chars]- Remediation
View remediation
65535 )); then printf 'Invalid port\n' >&2 exit 1 fi ``` 3. Restrict data-source identifiers to a documented allowlist or a conservative identifier pattern, such as letters, digits, underscores, and hyphens. 4. Reject control characters, newlines, carriage returns, quotation marks, and other syntax-breaking characters where they are not explicitly supported. 5. Generate JSON with a serializer such as `jq --arg`, rather than interpolating values into JSON text. 6. Generate Compose YAML with a YAML-aware library or start from a static template and update only validated scalar fields. 7. Validate generated files before use, for example with `docker compose config --quiet` and `jq -e . config/hosting.json`. 8. Do not automatically start or recommend starting generated infrastructure unless configuration validation succeeds. ]]>