T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:415- Finding
Unrestricted Output Path Allows Arbitrary File Overwrite
- Content
View full analysis
str: """Save generated plan to file.""" if not filepath: timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") filepath = f"dmsp_{timestamp}.md" Path(filepath).write_text(self.generated_content, encoding="utf-8") return filepath ``` ### Technical Analysis The `--output` argument is passed to `save_to_file()` and then used directly by `Path.write_text()`. There is no canonicalization, allowed-directory check, filename validation, exclusive-create mode, or symbolic-link protection. Consequently, the program can overwrite any existing file writable by the process. Absolute paths and parent-directory traversal sequences such as `../` are accepted. `Path.write_text()` also follows symbolic links, permitting a link at the selected output location to redirect the write to another writable target. This is especially relevant because the documentation's security checklist states that output should be restricted to the workspace and that `../` traversal should be rejected, but the implementation does neither. ### Attack Path 1. An attacker gains control over the `--output` value, such as through an automation job, service wrapper, CI parameter, or other system that invokes this script with externally supplied arguments. 2. The attacker supplies an absolute path or traversal path pointing to a file writable by the script's operating-system account: ```bash python scripts/main.py \ --project-title "Injected content" \ --pi-name "Attacker" \ --institutio ...[truncated 1411 chars]- Remediation
View remediation