T09 · Insecure Skill Coding Practices
Warning
- Location
monitor.py:256- Finding
Path Traversal Through an Unvalidated Product Name
- Content
View full analysis
1 else "default" # 获取天数参数（默认7天） days = 7 if len(sys.argv) > 2 and sys.argv[2] == "--days": if len(sys.argv) > 3: days = int(sys.argv[3]) # 检查产品目录是否存在 product_dir = os.path.join(BASE_DIR, product_name) if not os.path.exists(product_dir): print(f"❌ 产品 '{product_name}' 的目录不存在") print(f"请先告诉我要添加该产品的公众号") sys.exit(1) # 加载账号 accounts = load_accounts(product_name) if not accounts: print(f"❌ 产品 '{product_name}' 没有配置任何公众号") sys.exit(1) print(f"🔍 检查 {product_name} 的 {len(accounts)} 个公众号（近{days}天）...\n") # 检查更新 results = check_updates(accounts, days=days) if results and results[0].get('code') == 'AUTH_FAILED': print(results[0]['error']) sys.exit(1) # 生成报告 report = generate_report(product_name, results) # 保存报告 report_file = save_report(product_name, report) # 删除首次运行flag（如果存在） flag_file = os.path.join(product_dir, "first_run.flag") if os.path.exists(flag_file): os.remove(flag_file) ``` The same unvalidated value reaches the account-reading and report-writing operations: ```python def load_accounts(product_name): """加载指定产品的账号配置""" accounts_file = os.path.join(BASE_DIR, product_name, "accounts.json") ``` ```python def save_report(product_name, report): """保存报告到文件""" reports_dir = os.path.join(BASE_DIR, product_name, "reports") os.makedirs(reports_dir, exist_ok=True) today = datetime.now().strftime("%Y-%m-%d") report_file = os.path.join(reports_dir, f"{t ...[truncated 2558 chars]- Remediation
View remediation