T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/run.py:223- Finding
Unrestricted Local File Reading and Content Disclosure
- Content
View full analysis
str: title = spec["title"] summary = spec["summary"] sections = spec["sections"] bullets = [line.strip("- ").strip() for line in input_text.splitlines() if line.strip()] bullets = bullets[:18] out = [f"# {title} 结果", "", f"> 模式：{spec['mode']}", f"> 摘要：{summary}", ""] for idx, section in enumerate(sections): out.append(f"## {section}") if bullets: selected = bullets[idx::max(1, len(sections))][:3] for item in selected: out.append(f"- {item}") else: out.append("- 输入材料不足，请补充更具体的原始信息。") out.append("") out.append("## 待确认项") out.append(f"- 请补充：{spec.get('inputHint', '更完整的输入材料')}") out.append("") out.append("## 下一步") out.append("- 先审阅上述结构，再决定是否进入执行、发送、发布或系统变更。") return "\n".join(out).strip() + "\n" ``` ```python def build_report(spec: dict, source: Path, limit: int) -> str: mode = spec["mode"] if mode == "structured_brief": text = read_text(source) if source.exists() and source.is_file() else str(source) return make_structured_report(spec, text) ``` ```python parser.add_argument("--input", required=True, help="Input file, directory, or inline string.") ... source = Path(args.input).expanduser() if source.exists(): report = build_report(spec, source, args.limit) else: if spec["mode"] in {"directory_audit","csv_audit","pattern_audit","skill_audit"}: return fail(f"Input path does not exist: {source}") report = build_report(spec, Path(args.input), args.limit) ``` ### Technical Analysis The script accepts an arbitrary value through `--input`, expands the user directory marker, and checks whether ...[truncated 2180 chars]- Remediation
View remediation