T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/akshare_eval.py:12
- Finding
- Unrestricted Python Expression Evaluation Enables Arbitrary Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/akshare_eval.py`, lines 12–18 **Vulnerability Type**: Arbitrary Python code execution through unsafe `eval()` **Risk Level**: High ### Vulnerable Code ```python parser.add_argument('--expr', required=True, help='Python expression using ak, pd, or json.') parser.add_argument('--max-rows', type=int, default=20, help='Max rows to print for tabular outputs.') parser.add_argument('--format', choices=['csv', 'json', 'text'], default='csv') args = parser.parse_args() env = {'ak': ak, 'pd': pd, 'json': json} try: result = eval(args.expr, {'__builtins__': __builtins__}, env) ``` ### Technical Analysis The helper passes the entire user-supplied `--expr` value directly to Python's `eval()`. Although the documentation presents this argument as an expression using only `ak`, `pd`, or `json`, no such restriction is enforced. The global namespace explicitly exposes the complete `__builtins__` object. Consequently, an expression can access import functionality and other powerful built-ins rather than being limited to AKShare queries. It can load operating-system, subprocess, networking, and filesystem modules; inspect environment variables; read or modify files; initiate outbound connections; or execute local programs. This behavior materially exceeds the minimum privileges required to retrieve public financial data. Merely placing selected modules in the local environment does not create a security boundary when unrestricted built-ins and arbitrary attribute access remain available. ### Attack Path 1. An attacker supplies a financial-data request containing content designed to be incorporated into the `--expr` argument. 2. The agent or another caller invokes `scripts/akshare_eval.py` with that attacker-influenced expression. 3. The script passes the expression to `eval()` without syntax validation, method allowlisting, or isolation. 4. The expression uses exposed Python built-ins to import system-capa ...[truncated 1323 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Remove `eval()` and replace the expression interface with a constrained invocation format: 1. Accept an explicitly validated AKShare function name and JSON-encoded arguments. 2. Maintain an allowlist of supported AKShare methods appropriate for public market-data retrieval. 3. Resolve only direct attributes on the `akshare` module after validating the function name against the allowlist. 4. Validate argument names, types, lengths, symbols, and date ranges before invocation. 5. Reject private or dunder attributes and nested attribute traversal. 6. Do not expose Python built-ins, imports, arbitrary pandas operations, lambdas, comprehensions, or caller-supplied executable syntax. 7. Apply execution timeouts and response-size limits to constrain expensive data requests. 8. Run the query process in a sandbox with minimal filesystem access, a restricted environment, no unnecessary credentials, and network access limited to required financial-data endpoints. 9. Add tests confirming that imports, filesystem access, process creation, arbitrary attribute access, and network primitives cannot be reached through query input. If compatibility temporarily requires expression parsing, parse input with `ast.parse()` and permit only a narrowly defined grammar consisting of calls to allowlisted AKShare functions with literal arguments. AST filtering is still less robust than replacing the expression interface entirely. ]]>