T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:394- Finding
Unvalidated ABV Inputs Are Interpreted as bc Programs
- Content
View full analysis
/dev/null) local attenuation=$(echo "scale=1; (($og - $fg) / ($og - 1)) * 100" | bc 2>/dev/null) local calories=$(echo "scale=0; ((6.9 * (($og - $fg) / (1.775 - $og))) + 4 * (($fg - 1) * 1000 * 0.1)) * 3.55" | bc 2>/dev/null || echo "N/A") cat << EOF 🧮 ABV Calculation Results Original Gravity (OG): $og Final Gravity (FG): $fg ───────────────────────── ABV: ${abv}% Apparent Attenuation: ${attenuation}% Strength Category: $(if (( $(echo "$abv < 4" | bc -l 2>/dev/null || echo 0) )); then echo " 🟢 Session (under 4%)" elif (( $(echo "$abv < 6" | bc -l 2>/dev/null || echo 0) )); then echo " 🟡 Standard (4-6%)" elif (( $(echo "$abv < 8" | bc -l 2>/dev/null || echo 0) )); then ``` ### Technical Analysis The `og` and `fg` variables originate from command-line arguments and are inserted directly into strings passed to the `bc` interpreter. The script does not verify that these arguments contain only valid decimal gravity readings. Although this does not constitute direct shell-command injection—Bash does not reinterpret shell metacharacters introduced through ordinary parameter expansion—the supplied values become part of a `bc` program. An attacker can therefore introduce `bc` operators, statements, control structures, or computationally expensive expressions by terminating and reconstructing the surrounding arithmetic expression. Suppressing standard error with `2>/dev/null` does not prevent exploitation. It only conceals interpreter diagnostics. The same untrusted values are used in three separate calculations, while the resulting `abv` value is subsequently supplied to additional `bc` invocations. ### Attack Path 1. An attacker invok ...[truncated 1835 chars]- Remediation
View remediation
&2 return 1 fi ``` 2. Enforce brewing-specific bounds and relationships, such as: - OG and FG must fall within explicitly supported ranges. - OG must be greater than FG. - Denominators used by the formulas must not be zero. - Reject excessively long inputs before performing calculations. 3. Pass validated values to `bc` using `printf` rather than `echo`: ```bash abv=$(printf 'scale=2; (%s - %s) * 131.25\n' "$og" "$fg" | bc) ``` Validation is still mandatory because `printf` alone does not prevent `bc` injection. 4. Check whether `bc` is available and handle calculation failures explicitly: ```bash if ! command -v bc >/dev/null 2>&1; then printf '%s\n' "Error: bc is required for ABV calculations." >&2 return 1 fi ``` 5. Do not suppress all interpreter errors without reporting a safe failure. Verify that each result matches an expected numeric output pattern before using it in later calculations. 6. If the script is called by a network-facing or multi-user service, apply process timeouts and CPU or memory limits as defense in depth. ]]>