T09 · Insecure Skill Coding Practices
Error
- Location
src/deploy-manager.js:33- Finding
Shell Command Injection Through Deployment Configuration
- Content
View full analysis
nul || true`); await execAsync(`docker rm ${this.config.containerName} 2>nul || true`); // Start the new container const { stdout } = await execAsync( `docker run -d -p ${this.config.port}:${this.config.port} ` + `--name ${this.config.containerName} ${this.config.imageName}:latest` ); ``` ```javascript const { stdout } = await execAsync( `docker ps -q -f name=${this.config.containerName}` ); ``` ```javascript const { stdout } = await execAsync( `netstat -an | findstr :${this.config.port}` ); ``` ```javascript const { stdout } = await execAsync( `docker logs --tail ${lines} ${this.config.containerName}` ); ``` ```javascript await execAsync(`docker stop ${this.config.containerName}`); ``` ### Technical Analysis The application executes Docker and operating-system commands through `child_process.exec`. Unlike an argument-based process API, `exec` passes the constructed string to a command shell. The following caller-controlled values are directly interpolated into shell commands without validation or escaping: - `config.imageName` - `config.containerName` - `config.port` - The `lines` argument passed to `getLogs()` An attacker who can control any of these values can introduce shell metacharacters such as command separators, substitutions, redirections, or pipelines. The shell will interpret the injected content as an additional command rather than as a Docker argument. The constructor also applies `...config` after the default properties, so arbitrary supplied values remain accepted wit ...[truncated 1748 chars]- Remediation
View remediation