T09 · Insecure Skill Coding Practices
Error
- Location
voice-clone.py:229- Finding
Shell Command Injection Through the User-Controlled Output Path
- Content
View full analysis
/dev/null 2>&1 &") except: pass ``` The output path originates from the unrestricted command-line option: ```python parser.add_argument( "-o", "--output", type=str, help="输出文件路径" ) ``` ### Technical Analysis The `--output` argument is controlled by the caller and is passed to the selected synthesis function as the output filename. These functions return that value as `output_file`. After synthesis succeeds, the application interpolates `output_file` directly into a command string passed to `os.system()`. `os.system()` invokes a shell. Wrapping the value in single quotes is not sufficient because a filename containing a single quote can terminate the quoted argument and introduce shell metacharacters. The code does not escape or validate the value before shell interpretation. The surrounding `try/except` does not prevent exploitation. `os.system()` generally reports command failure through its numeric return value rather than raising an exception, and any injected command has a ...[truncated 1696 chars]- Remediation
View remediation