Arbitrary Code Execution via `eval()` with Dynamic String Concatenation

Open Beginner friendly
  • Is something wrong?
#244 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, python
Domain
devtools, security

Research direction

Start with skills/cloud/apigee-agent-gateway-governance/scripts/assess_integration.sh, especially the jqf() definition at lines 163–171 and its call at lines 479–480. Trace how CACHE_INDEX_ID reaches the Python expression and review ways to pass it as data instead of executable code. Done means the index name cannot inject Python through this path and the JSON lookup still returns the expected dimensions.

Written by the indexing model from the issue text.

Description

Arbitrary Code Execution via eval() with Dynamic String Concatenation
  • Severity: High
  • Vulnerability Type: Code Injection (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code)
  • Affected File: skills/cloud/apigee-agent-gateway-governance/scripts/assess_integration.sh (Lines 163–171, 479–480)
Description

The shell utility function jqf() is designed to extract JSON properties without requiring a native jq binary by spawning a Python inline script that executes eval(sys.argv[1]):

jqf() {  # jqf <json> <python-expr over d> -- no jq dependency
  python3 -c '
import json,sys
try: d=json.loads(sys.stdin.read() or "{}")
except Exception: d={}
try: print(eval(sys.argv[1]))
except Exception: print("")
' "$1" 2>/dev/null || true
}

In lines 479–480 of the same script, the dynamically resolved shell variable CACHE_INDEX_ID is interpolated directly into the Python expression using string concatenation:

CACHE_DIMS="$(jqf 'next((str(i.get("metadata",{}).get("config",{}).get("dimensions","")) for i in d if i["name"].endswith("'"$CACHE_INDEX_ID"'")), "")' <<<"$IDX_JSON")"
Impact

Because $CACHE_INDEX_ID is concatenated directly into the Python code string without escaping or input validation, any single quote (') present in the index identifier breaks out of the string boundary. This allows arbitrary Python code execution under the privileges of the script runner when processing untrusted, malformed, or hostile index names.

Recommended Remediation
  1. Eliminate eval(): Replace the dynamic evaluation with safe dictionary lookups passed via explicit arguments or environment variables.
  2. Dedicated CLI JSON Parsing: If jq is unavailable, write a dedicated, parameter-safe Python helper script that parses JSON paths without executing arbitrary Python statements:
jqf_safe() {
  python3 -c '
import json, sys
try:
    data = json.load(sys.stdin)
    target_id = sys.argv[1]
    for item in data:
        if item.get("name", "").endswith(target_id):
            print(item.get("metadata", {}).get("config", {}).get("dimensions", ""))
            break
except Exception:
    pass
' "$CACHE_INDEX_ID" <<<"$IDX_JSON"
}
Dominant language
Python
Stars
23.1k
Forks
1.9k
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from google/skills

All issues in google/skills

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.