AntFleet

Disagreement · b6cf244f-anthropic-7

feed.sh injects $LIMIT into jq filter via shell concatenation — non-numeric LIMIT can break or inject

solo Opus
repo a16d2030·PR #5·reviewed 1 week ago

Opus finding

feed.sh injects $LIMIT into jq filter via shell concatenation — non-numeric LIMIT can break or inject

lowsecuritymedium
  • bankr-signals/scripts/feed.sh:44-47
$LIMIT is interpolated into the jq program text without validation. A user passing `--limit '10] | .[0]'` or similar can alter jq behavior; passing a non-integer (e.g. `abc`) produces a jq syntax error. Use `--argjson limit` instead.

Recommendation

Use `jq -s --argjson limit "$LIMIT" 'add | sort_by(-.post_timestamp) | .[0:$limit]'` and validate LIMIT is an integer at argparse time.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.

← back to all disagreementsview public receiptssee unanimous findings + anatomies →
Tweet ↗