T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/init_profile.py:38- Finding
Shell Command Injection in Generated Cron Command
- Content
View full analysis
str: return raw.replace("\\", "\\\\").replace('"', '\\"') def build_cron_command(state: dict) -> str | None: profile = state.get("profile") daily_fortune = state.get("daily_fortune") if not isinstance(profile, dict) or not isinstance(daily_fortune, dict): return None daily_time = daily_fortune.get("time") timezone = daily_fortune.get("timezone") or "Asia/Shanghai" lunar_birthday = profile.get("lunar_birthday") gender = profile.get("gender") if not daily_time or not lunar_birthday or not gender: return None if ":" not in daily_time: return None hour_text, minute_text = daily_time.split(":", 1) if not hour_text.isdigit() or not minute_text.isdigit(): return None hour = int(hour_text) minute = int(minute_text) if hour < 0 or hour > 23 or minute < 0 or minute > 59: return None birth_hour = profile.get("birth_hour") or "未提供" cron_expr = f"{minute} {hour} * * *" message = ( "请启用 king-wen-hexagrams 技能，为我生成今日运势。" f"命主资料如下：农历生日={lunar_birthday}；性别={gender}；出生时辰={birth_hour}。" "请结合今天的日期，起一卦看当日气机，只输出：今日卦势、气机偏向、宜、忌、一句收束。" "口吻保持庄重、简洁、克制，不要夸张渲染神秘。" ) return ( "openclaw cron add \\\n" ' --name "文王每日运势" \\\n' f' --cron "{cron_expr}" \\\n' f' --tz "{timezone}" \\\n' ' --session isolated \\\n' f' --message "{quote_message(message)}" \\\n' " --announce" ) ``` ### Technical Analysis The function generates a shell command containing values derived from user-controlled profile and scheduling fields. The custom `quote_message()` function escapes only backslashes and double quotation ma ...[truncated 1938 chars]- Remediation
View remediation