T09 · Insecure Skill Coding Practices
Note
- Location
scripts/script.sh:112- Finding
Option Injection Through the Search Term
- Content
View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The attacker-controlled `term` is passed to `grep` as a positional argument without an end-of-options marker such as `--`. If the value begins with a hyphen, GNU `grep` may interpret it as an option rather than as the intended search pattern. Quoting `"$term"` prevents shell word splitting and wildcard expansion, but it does not prevent the called program from interpreting the argument as an option. An option-shaped term can consequently modify `grep` behavior, request patterns from another file, produce unexpected output, or consume excessive resources. The impact is constrained because the selected search targets are the application log files and the script executes with the privileges of the invoking user. No privilege escalation or direct shell command injection is present. ### Attack Path 1. An attacker influences a value passed to `tidyfiles search`. 2. The attacker supplies an option-shaped value instead of a normal search expression. 3. `_search` invokes `grep -i "$term" "$f"` without `--`. 4. `grep` parses the attacker-controlled value as an option. 5. Search behavior changes, potentially causing unexpected file reads for pattern input, misleading output, errors, or local resource consumption. ### Impact Assessment The vulnerability can affect the availability and integrity of search results. Depending on the installed `grep` implementation and supplied options, it ma ...[truncated 212 chars]- Remediation
View remediation
/dev/null || true) ``` Additional hardening measures include: - Validate the maximum search-term length to limit resource consumption. - Use `grep -e "$term" -- "$f"` if regular-expression support is intentional. - Document whether search terms are interpreted as literal strings or regular expressions. - Avoid storing command output in one large shell variable if log files can become large; stream matching results instead. ]]>