T09 · Insecure Skill Coding Practices
Warning
- Location
deepseek_reasonix.py:11- Finding
Predictable Shared Temporary Cache Permits Symbolic-Link File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
deepseek_reasonix.py, lines 11–42
Vulnerability Type: Insecure temporary-file handling and symbolic-link following
Risk Level: MediumVulnerable Code
python def get_prefix_cache(): cache_dir = pathlib.Path(tempfile.gettempdir()) / 'deepseek-reasonix' cache_dir.mkdir(exist_ok=True) return cache_dir def hash_code(code): return hashlib.sha256(code.encode()).hexdigest() def get_code_suggestions(code, context): # Simple suggestion engine, replace with a more sophisticated one suggestions = [] for line in context.splitlines(): if re.search(r'\b' + re.escape(code) + r'\b', line): suggestions.append(line.strip()) return suggestions def run(param=""): cache_dir = get_prefix_cache() code_context = get_code_context() code_hash = hash_code(code_context) cache_file = cache_dir / f'{code_hash}.json' if cache_file.exists(): with cache_file.open() as f: cache_data = json.load(f) else: cache_data = {} if param: suggestions = get_code_suggestions(param, code_context) cache_data[param] = suggestions with cache_file.open('w') as f: json.dump(cache_data, f)Technical Analysis
The cache is placed in the system-wide temporary directory under the predictable path
deepseek-reasonix. Its filename is the SHA-256 hash of the script's static source code, so any local user who can read the package can calculate the exact cache path in advance.The code does not:
- Create a private cache directory with restrictive permissions.
- Verify that the directory is owned by the invoking user.
- Verify that the cache file is a regular file.
- Reject symbolic links when opening the cache.
- Use secure exclusive creation or atomic replacement.
- Validate the size and struc ...[truncated 2474 chars]
- Remediation
View remediation
Remediation Suggestions
- Store cache data in a per-user cache location rather than a system-wide predictable temporary directory, such as a platform-appropriate user cache directory.
- Create the cache directory with mode
0700and verify that it is a real directory owned by the current user. - Reject symbolic links and non-regular files. On supported platforms, open files using
os.open()withO_NOFOLLOW, then verify the resulting descriptor withos.fstat(). - Write updates to a securely created temporary file in the verified cache directory, flush and close it, and atomically install it with
os.replace(). - Apply restrictive file permissions such as
0600to cache files. - Validate existing cache files before loading them, including a reasonable maximum size, valid JSON structure, and expected key and value types.
- Treat ownership, type, or permission validation failures as unsafe cache state and refuse to read or overwrite the affected path.