T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:113- Finding
Option Injection Through the Search Term
- Content
View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The search term is quoted, which prevents shell metacharacters from being evaluated as shell syntax. However, quoting does not prevent `grep` from interpreting an argument beginning with `-` as a command-line option. Consequently, an attacker who can invoke the CLI can supply values such as `-e.*` or `--file=/path/to/file`. These values alter `grep` behavior rather than being processed as literal search terms. A file supplied through `--file` is interpreted as a source of patterns. Special or very large files may also cause excessive resource consumption. The vulnerability does not provide shell command execution because the value is not passed through `eval`, `sh -c`, or an equivalent execution primitive. ### Attack Path 1. An attacker or untrusted caller controls the argument passed to `lifegoals search`. 2. The attacker supplies an option-shaped argument, for example: ```bash lifegoals search '--file=/path/to/attacker-selected-file' ``` 3. `_search` passes the value directly to `grep` without an `--` option terminator. 4. `grep` interprets the value as an option and reads the selected file as a pattern source. 5. The attacker can alter search results or cause resource consumption by selecting a large or special file. ### Impact Assessment The issue permits manipulation of search behavior and may cause denial of service or unintended reads of files already access ...[truncated 411 chars]- Remediation
View remediation
}" echo "Searching for: $term" local f m for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue m=$(grep -iF -- "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" printf '%s\n' "$m" | sed 's/^/ /' fi done } ``` The `--` marker prevents subsequent values from being parsed as options, while `-F` treats the search term as a literal string rather than a regular expression. Add regression tests covering `-e`, `--file`, strings beginning with `-`, empty strings, and ordinary search terms. ]]>