T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/stock_analyst.py:536
- Finding
- Path Traversal Through Unsanitized Ticker in Report Filename<![CDATA[ ## Vulnerability Details **File Location**: `scripts/stock_analyst.py:536-537, 584-587`; duplicated in `US Stock Analyst 0210v1/stock_analyst.py:536-537, 584-587` **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```python api_key = input("Enter your AIsa API key: ") ticker = input("Enter stock ticker (e.g., NVDA, AAPL): ").strip().upper() ``` ```python # Save report filename = f"{ticker}_analysis_{datetime.now().strftime('%Y%m%d')}.json" with open(filename, "w") as f: json.dump(report, f, indent=2) ``` ### Technical Analysis The application accepts the ticker as unrestricted user input and later embeds it directly into a filesystem path. Calling `strip()` and `upper()` does not remove path separators, `..` traversal components, absolute-path syntax, or platform-specific filename characters. The file is opened in write mode, which creates a new file or truncates an existing file. Consequently, a ticker containing traversal components can cause the report to be written outside the intended working directory. The data-gathering failures that may result from an invalid ticker do not reliably prevent exploitation because individual API errors are caught and converted into result objects. Report synthesis and file creation can therefore still occur. ### Attack Path 1. An attacker or untrusted caller runs the interactive script. 2. The caller supplies a ticker containing path traversal components, such as `../../target`. 3. The value is uppercased but remains a path containing `../`. 4. The script appends `_analysis_<date>.json` to the attacker-controlled path. 5. `open(filename, "w")` resolves the traversal and writes outside the current directory. 6. If the resolved destination already exists and the process can write to it, the destination is truncated and replaced with JSON report content. ### Impact Assessment Exploitation grants filesystem write capability under the privileges ...[truncated 455 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Validate ticker symbols against a strict allowlist pattern before making API requests or constructing filenames. For example: ```python import re if not re.fullmatch(r"[A-Z][A-Z0-9.-]{0,9}", ticker): raise ValueError("Invalid stock ticker") ``` - Reject `/`, `\`, `..`, null bytes, drive prefixes, and other platform-specific path syntax. - Store reports beneath a dedicated, explicitly configured output directory. - Resolve the final path and verify that it remains beneath the approved directory: ```python from pathlib import Path output_dir = Path("reports").resolve() output_dir.mkdir(parents=True, exist_ok=True) output_path = (output_dir / f"{ticker}_analysis_{date}.json").resolve() if output_dir not in output_path.parents: raise ValueError("Output path escapes the report directory") ``` - Consider exclusive file creation or an explicit overwrite confirmation where replacement is not intended. - Apply the correction to both duplicated implementations. ]]>