T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sih_api.py:153- Finding
Arbitrary Local File Disclosure Through Image Upload
- Content
View full analysis
str: """ 将本地文件转换为Base64格式 Args: file_path: 文件路径 Returns: data:image/...;base64,... 格式的字符串 """ # 读取文件 with open(file_path, "rb") as f: image_data = f.read() # 编码为Base64 base64_data = base64.b64encode(image_data).decode("utf-8") # 获取图片格式 ext = Path(file_path).suffix.lower().lstrip(".") if ext not in ["jpg", "jpeg", "png", "webp", "gif"]: ext = "jpg" # 默认 return f"data:image/{ext};base64,{base64_data}" ``` ### Technical Analysis The client accepts any path for which `os.path.exists()` returns true. It does not require the path to reference a regular image file, constrain it to a user-approved directory, validate its actual media type, or verify that an image decoder can parse it. Unsupported file extensions are not rejected. Instead, arbitrary file contents are Base64-encoded and labeled as JPEG data. The resulting data URI is inserted into the JSON payload and transmitted to `htt ...[truncated 1729 chars]- Remediation
View remediation