T09 · Insecure Skill Coding Practices
Error
- Location
scripts/multi_wechat.sh:6- Finding
Unvalidated Count Argument Enables Shell Command Execution Through Arithmetic Expansion
- Content
View full analysis
- Remediation
View remediation
&2 exit 2 fi if (( 10#$COUNT > MAX_COUNT )); then echo "ERROR: count must not exceed $MAX_COUNT" >&2 exit 2 fi COUNT=$((10#$COUNT)) ``` The `10#` prefix forces decimal interpretation and avoids unintended octal behavior for values containing leading zeroes. The regular-expression check must occur before any arithmetic evaluation of the untrusted value. Replace `seq` command substitutions with native arithmetic loops after validation: ```bash for ((i = 2; i <= COUNT + 1; i++)); do # Existing loop body done ``` Apply the same change to all four loops currently located at lines 23, 46, 89, and 96. Additional hardening should include: 1. Reject zero, negative values, signs, whitespace, arithmetic operators, variable names, brackets, and command-substitution syntax. 2. Keep the maximum count low enough to prevent accidental disk exhaustion. 3. Check available disk space before copying application bundles. 4. Ensure any Agent invoking the script passes only a validated integer; this should supplement, not replace, script-side validation. 5. Avoid constructing privileged shell command strings. If privileged deletion remains necessary, pass only internally generated, strictly validated paths and quote each path safely. ]]>