T09 · Insecure Skill Coding Practices
Error
- Location
scripts/enterprise_kb_manager.py:238- Finding
Arbitrary File Write Through Unsanitized Knowledge-Base Index Fields
- Content
View full analysis
- Remediation
View remediation
Path: if not re.fullmatch(r"[A-Za-z0-9_-]{1,100}", name): raise ValueError("Invalid identifier") root = root.resolve() destination = (root / name).resolve() if destination.parent != root: raise ValueError("Path escapes storage root") return destination ``` 4. Apply validation separately to `incident_id`, `crisis_type`, `device_type`, and `crisis_level`. 5. Use normalized internal identifiers rather than raw imported labels for directory names. 6. Consider exclusive creation mode (`"x"`) or explicit collision handling to prevent silent overwrite. 7. Validate the entire imported event against a schema before indexing it. 8. Run ingestion under a low-privilege service account with write access limited to the intended data directory. ]]>