T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:31- Finding
Directory Scan Boundary Bypass Through Symbolic Links
- Content
View full analysis
= limit: break if path.is_file(): if path.suffix.lower() in {".md",".txt",".json",".yaml",".yml",".py",".js",".ts",".csv",".tsv",".sh"}: results.append(path) return results ``` ```python def pattern_report(spec: dict, path: Path, limit: int) -> str: targets = [path] if path.is_file() else list_text_files(path, limit=limit) findings = [] for target in targets: text = read_text(target) for name, pattern in PATTERNS.items(): for match in re.finditer(pattern, text, flags=re.IGNORECASE): snippet = match.group(0) if "secret_like" == name: snippet = re.sub(r"([A-Za-z0-9_\-]{4})[A-Za-z0-9_\-]+", r"\1***", snippet) findings.append((str(target), name, snippet[:160])) ``` ### Technical Analysis The directory scanner recursively discovers entries with `Path.rglob()` and accepts them when `Path.is_file()` returns true. Both `is_file()` and the subsequent `read_text()` operation follow symbolic links. The implementation does not reject symbolic links or resolve each candidate and verify that its canonical path remains inside the requested scan root. Consequently, a directory supplied by an untrusted party can contain a symbolic link whose filename has an accepted extension but whose target is outside the directory. The scanner will read the external target using the operating-system permissions of the process running the Skill. The built-in pattern scanner only includes matched portions of a file in its report, which limits disclosure, ...[truncated 1652 chars]- Remediation
View remediation