T09 · Insecure Skill Coding Practices
Error
- Location
layers/asset_generator.py:243- Finding
Arbitrary Python Code Execution Through Unsafely Generated Source Code
- Content
View full analysis
2000: raise ValueError(f"description 不能超过 2000 个字符") # 危险字符过滤（防止 shell 注入等） dangerous_chars = [";", "|", "$(", "`", "&&", "||", ">", "<", "&"] for char in dangerous_chars: if char in self.description: raise ValueError( f"description 包含危险字符: '{char}'，可能存在注入风险" ) ``` `layers/asset_generator.py:243-250`: ```python def _generate_main_py(self, project_name: str, description: str) -> str: """生成主程序模板""" return f'''""" {project_name} — {description} """ import sys ``` `layers/verifier.py:217-229`: ```python env = os.environ.copy() existing_path = env.get("PYTHONPATH", "") env["PYTHONPATH"] = f"{target_dir}{os.pathsep}{existing_path}" if existing_path else str(target_dir) result = subprocess.run( [sys.executable, "-m", "pytest", str(test_dir), "-v", "--tb=short"], capture_output=True, text=True, cwd=isolated_cwd, timeout=60, env=env, ) ``` ### Technical Analysis The request validator attempts to prevent shell injection by rejecting a small list of shell metacharacters. That validation is not appropriate for data that is later interpolated directly into Python source code. The `description` value is inserted without escaping into a triple-quoted module docstring. Newlines, quotation marks, backslashes, and triple-quote sequences are not rejected or encoded. An attacker can therefore terminate the generated docstring, insert Python statements, and optionally reopen a string so the resulti ...[truncated 2100 chars]- Remediation
View remediation