T09 · Insecure Skill Coding Practices
Warning
- Location
- .
- Finding
- Unescaped User Input in JSON Request Bodies<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/address-info.sh:7-10` - `scripts/token-audit.sh:7-10` - `scripts/trading-signal.sh:5-9` - `scripts/market-rank.sh:35-40` **Vulnerability Type**: Improper construction of JSON using untrusted input **Risk Level**: Medium ### Vulnerable Code `scripts/address-info.sh:7-10` ```bash curl -s "https://web3.binance.com/bapi/defi/v1/wallet-direct/buw/wallet/token/balance" \ -H "Content-Type: application/json" \ -H "Accept-Encoding: identity" \ -d "{\"address\":\"$ADDRESS\",\"chainId\":\"$CHAIN\"}" | jq '.' ``` `scripts/token-audit.sh:7-10` ```bash curl -s "https://web3.binance.com/bapi/defi/v1/wallet-direct/buw/wallet/governance/token/info" \ -H "Content-Type: application/json" \ -H "Accept-Encoding: identity" \ -d "{\"symbol\":\"$SYMBOL\",\"chainId\":\"$CHAIN\"}" | jq '.' ``` `scripts/trading-signal.sh:5-9` ```bash curl -s "https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money" \ -H "Content-Type: application/json" \ -H "Accept-Encoding: identity" \ -d "{\"smartSignalType\":\"\",\"page\":1,\"pageSize\":20,\"chainId\":\"${CHAINID}\"}" | jq '.' ``` `scripts/market-rank.sh:35-40` ```bash curl -s -x "$PROXY" \ "https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money" \ -H "Accept-Encoding: identity" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ -d "{\"smartSignalType\":\"\",\"page\":1,\"pageSize\":15,\"chainId\":\"$CHAIN\"}" | jq '.data[]? | {token: .ticker, chain: .chainId, platform: .launchPlatform} ' 2>/dev/null ``` ### Technical Analysis Caller-controlled values are interpolated directly into JSON text without JSON escaping or input-format validation. Inputs containing quotation marks, commas, braces, or duplicate property names can terminate the intended string value and alter the structure of the request body. The values are enclosed in shell quotes, so this ...[truncated 1133 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Construct request bodies with a JSON-aware utility instead of string interpolation: ```bash jq -n \ --arg address "$ADDRESS" \ --arg chainId "$CHAIN" \ '{address: $address, chainId: $chainId}' | curl -s "https://web3.binance.com/..." \ -H "Content-Type: application/json" \ -H "Accept-Encoding: identity" \ --data-binary @- ``` - Validate chain IDs against the documented allowlist, such as `56`, `8453`, `1`, and `CT_501`. - Validate EVM addresses with a strict hexadecimal-address pattern and apply chain-specific validation for non-EVM addresses. - Restrict token symbols to an explicitly supported character set and reasonable length. - Add argument-presence checks and terminate with a nonzero status when validation fails. - Use `curl --fail-with-body --show-error` and handle non-success responses explicitly. ]]>