T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish.py:153- Finding
Shell Command Injection Through User-Controlled Theme and Generated File Paths
- Content
View full analysis
str: """ Prepare the publishing command. Args: article_path: Article file path cover_path: Cover image file path Returns: Complete publishing command """ command = f"{PUBLISH_CONFIG['sau_command']} {PUBLISH_CONFIG['platform']} {PUBLISH_CONFIG['account_name']} upload-article \"{article_path}\" --cover \"{cover_path}\"" return command def execute_publish_command(self, command: str) -> Dict[str, Any]: """ Execute the publishing command. Args: command: Publishing command Returns: Publishing result dictionary """ print(f"Executing publishing command: {command}") try: result = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=300 ) ``` The input validation permits nearly all shell metacharacters: ```python def validate_theme(self, theme: str) -> bool: if not theme or not isinstance(theme, str) or len(theme.strip()) == 0: return False if len(theme) > 100: return False return True ``` The theme is subsequently embedded in an article filename: ```python timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") filename = f"article_{theme.replace(' ', '_')}_{timestamp}.md" filepath = os.path.join(ARTICLES_DIR, filename) with open(filepath, "w", encoding="utf-8") as f: f.write(full_content) ``` ### Technical Analysis The publisher constructs one command string and executes it through a shell. The article and cover paths are enclosed in double quotes, but embedded double quotes, comma ...[truncated 2194 chars]- Remediation
View remediation