T09 · Insecure Skill Coding Practices
Error
- Location
core/wps_generator.py:33- Finding
AppleScript Injection Through Conversation-Derived Slide Content
- Content
View full analysis
str: script_file = os.path.join( self.applescript_dir, f"script_{len(self.script_files)}.applescript" ) with open(script_file, 'w', encoding='utf-8') as f: f.write(script_content) self.script_files.append(script_file) return script_file def _execute_apple_script(self, script_file: str) -> bool: try: result = subprocess.run( ['osascript', script_file], capture_output=True, text=True, timeout=30 ) if result.returncode == 0: return True else: print(f"AppleScript执行失败: {result.stderr}") return False ``` Conversation-derived fields are then inserted directly into the executable script: ```python script = f''' tell application "WPS Office" activate delay 1 -- 创建新演示文稿 make new presentation delay 1 -- 设置标题 tell active presentation tell slide 1 set title of shape 1 to "{structure.title}" -- 设置标题格式 set font of text range of shape 1 to "微软雅黑" set size of font of text range of shape 1 to 44 set color of font of text range of shape 1 to {{0, 122, 255}} end tell -- 添加副标题 if "{structure.subtitle}" is not "" then tell slide 1 set subtitle_shape to make new shape at end with properties {{type: text box}} set content of subtitle_shape to "{structure.subtitle}" end tell end if end tell end tell ''' script_file = self._create_apple_script(script) success = self._execute_apple_script(script_file) ``` The same unsafe interpolation pattern is used for slide titl ...[truncated 2225 chars]- Remediation
View remediation