T09 · Insecure Skill Coding Practices
Error
- Location
scripts/design_system.py:508- Finding
Path Traversal Allows Files to Be Written Outside the Intended Design-System Directory
- Content
View full analysis
- Remediation
View remediation
str: slug = value.strip().lower().replace(" ", "-") if not re.fullmatch(r"[a-z0-9][a-z0-9_-]{0,63}", slug): raise ValueError("Invalid project or page name") return slug ``` 2. Resolve the intended root and every destination before writing: ```python root = (base_dir / "design-system").resolve() project_dir = (root / safe_slug(project_name)).resolve() pages_dir = (project_dir / "pages").resolve() page_file = (pages_dir / f"{safe_slug(page)}.md").resolve() ``` 3. Verify containment with `Path.relative_to()`: ```python try: page_file.relative_to(pages_dir) except ValueError: raise ValueError("Output path escapes the pages directory") ``` 4. Reject absolute paths, path separators, `..`, drive prefixes, and empty names before constructing output paths. 5. Consider using exclusive creation mode (`'x'`) by default. Require an explicit overwrite option before truncating existing files. 6. Check for symbolic links in parent directories when operating in an untrusted workspace. Where practical, refuse to write through symlinked output directories. 7. Add tests covering Unix and Windows traversal forms, absolute paths, nested separators, symlink escapes, and overwrite attempts. ]]>