T09 · Insecure Skill Coding Practices
- Location
scripts/fetch_comments.sh:5- Finding
Unvalidated count argument enables local file disclosure through outbound YouTube requests
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fetch_comments.sh, lines 5-15
Vulnerability Type: Shell argument injection and unintended local file disclosure
Risk Level: HighVulnerable Code
bash MAX_RESULTS=${2:-10} OUTPUT_DIR="youtube_comments" mkdir -p "$OUTPUT_DIR" echo "🔍 搜索: $SEARCH_TERM (最多 $MAX_RESULTS 个视频)" # 搜索视频并获取评论 yt-dlp "https://www.youtube.com/results?search_query=$(echo $SEARCH_TERM | tr ' ' '+')" \ --dump-json --flat-playlist 2>/dev/null | \ jq -r '.id' | head -$MAX_RESULTS | while read video_id; doTechnical Analysis
The second positional argument is accepted as
MAX_RESULTSwithout validating that it is a positive integer. It is then expanded without quotation in:bash head -$MAX_RESULTSShell word splitting allows an attacker-controlled value containing whitespace to introduce additional arguments to
head. For example, a value such as10 /etc/hostnameresults in an effective invocation resembling:bash head -10 /etc/hostnameInstead of processing only the piped YouTube search results,
headreads the attacker-selected local file. Its lines are passed to thewhile read video_idloop. A line that is suitable for use as a filename is subsequently embedded in a YouTube URL by the code later in the loop:bash output_file="$OUTPUT_DIR/${video_id}.json" yt-dlp --write-comments --dump-json \ "https://www.youtube.com/watch?v=$video_id" \ > "$output_file" 2>/dev/nullThis does not provide arbitrary shell command execution because the resulting
video_idand output path are quoted. However, it can cause content from arbitrary files readable by the current process to be transmitted as part of an outbound request to YouTube. Files containing slashes or otherwise invalid path components may cause output redirection to fail, but files with simple line content remain exploitable.Attack Path
- A ...[truncated 1525 chars]
- Remediation
View remediation
Remediation Suggestions
Validate the argument before it reaches any command and use the explicit, quoted
headoption:bash MAX_RESULTS=${2:-10} if ! [[ "$MAX_RESULTS" =~ ^[1-9][0-9]*$ ]]; then echo "Error: count must be a positive integer" >&2 exit 1 fi if (( MAX_RESULTS > 100 )); then echo "Error: count must not exceed 100" >&2 exit 1 fi jq -r '.id' | head -n "$MAX_RESULTS" | while IFS= read -r video_id; do # ... doneAdditionally, validate each returned video identifier before using it in a URL or filesystem path:
bash if ! [[ "$video_id" =~ ^[A-Za-z0-9_-]{11}$ ]]; then echo "Skipping invalid video ID" >&2 continue fiUse
printf '%s' "$SEARCH_TERM"rather than unquotedecho, and consider enabling defensive shell options such asset -euo pipefailafter confirming that expected pipeline behavior is handled correctly.