I have a situation where a Bash script runs and parses a user-supplied JSON file using jq
. Since it's supplied by the user, it's possible for them to include values in the JSON to perform an injection attack.
I'd like to know if there's a way to overcome this. Please note, the setup of: 'my script parsing a user-supplied JSON file' cannot be changed, as it's out of my control. Only thing I can control is the Bash script.
I've tried using jq
with and without the -r
flag, but in each case, I was successfully able to inject.
Here's what the Bash script looks like at the moment:
#!/bin/bash
set -e
eval "INCLUDES=($(cat user-supplied.json | jq '.Include[]'))"
CMD="echo Includes are: "
for e in "${INCLUDES[@]}"; do
CMD="$CMD\\\"$e\\\" "
done
eval "$CMD"
And here is an example of a sample user-supplied.json
file that demonstrates an injection attack:
{
"Include": [
"\\\";ls -al;echo\\\""
]
}
The above JSON file results in the output:
Includes are: ""
, followed by a directory listing (an actual attack would probably be something far more malicious).
What I'd like instead is something like the following to be outputted:
Includes are: "\\\";ls -al;echo\\\""
Edit 1
I used echo
as an example command in the script, which probably wasn’t the best example, as then the solution is simply not using eval
.
However the actual command that will be needed is dotnet test
, and each array item from Includes
needs to be passed as an option using /p:<Includes item>
. What I was hoping for was a way to globally neutralise injection regardless of the command, but perhaps that’s not possible, ie, the technique you go for relies heavily on the actual command.
Include
array, why are youeval
ing (twice)?INCLUDES=( $(jq '.Include[]' user-supplied.json) )
does what you want, without executing any user-supplied input. You may need to adjust some ofjq
's options to get the shell array that you want, but nothing requiringeval
.