T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/standup.sh:41- Finding
Unescaped Attacker-Controlled Values in JSON Output
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi if (( HOURS < 1 )); then echo "Error: --hours must be greater than zero" >&2 exit 1 fi ``` 4. Validate `FORMAT` against an explicit allowlist and reject unsupported values: ```bash case "$FORMAT" in text|json) ;; *) echo "Error: --format must be text or json" >&2 exit 1 ;; esac ``` 5. Build commit entries through the serializer. For example: ```bash commits_json=$( while IFS= read -r line; do [[ -z "$line" ]] && continue jq -cn --arg subject "$line" '{subject: $subject}' done <<< "$COMMITS" | jq -s '.' ) jq -n \ --arg date "$DATE" \ --arg author "${AUTHOR:-all}" \ --argjson hours "$HOURS" \ --argjson commits "$commits_json" \ '{ date: $date, lookbackHours: $hours, author: $author, commitCount: ($commits | length), commits: $commits }' ``` 6. Add regression tests using commit subjects and author filters containing quotation marks, backslashes, tabs, Unicode text, and other control characters. Parse all generated output with a strict JSON parser to verify validity. ]]>