T09 · Insecure Skill Coding Practices
- Location
modules/storage-patterns.md:163- Finding
Path Traversal Through an Unsanitized Session Identifier
- Content
View full analysis
Vulnerability Details
File Location:
modules/storage-patterns.md, lines 163–166
Vulnerability Type: Path traversal leading to arbitrary file creation or replacement
Risk Level: Mediumpython def write_session(session_dir: Path, session_id: str, data: dict) -> None: target = session_dir / f"{session_id}.json" write_atomic_json(target, data) # see Atomic WritesTechnical Analysis
The example directly interpolates
session_idinto a filesystem path without validating its format or verifying that the resolved destination remains insidesession_dir.An identifier containing parent-directory components, such as
../config, causes the generated path to escape the intended session directory. The subsequent atomic-write routine protects against partial writes but does not provide path containment or traversal protection. Because this is documentation rather than packaged executable code, exploitation requires a consumer to adopt the pattern in an application and pass attacker-controlled identifiers to it.Attack Path
- An application copies or implements the documented
write_sessionpattern. - The application accepts a session identifier from an untrusted source.
- An attacker supplies an identifier containing traversal components, such as
../config. - The expression constructs a path outside
session_dir, such assession_dir/../config.json. write_atomic_jsoncreates or replaces that destination with attacker-influenced JSON data.- If the process can write to a security-sensitive location and the resulting file is consumed by another component, the attacker may alter application behavior or corrupt data.
Impact Assessment
Successful exploitation can create or replace JSON files outside the intended session directory within the filesystem permissions of the hosting process. The precise scope depends on the process account, directory permissions, attacker control over
data, and ...[truncated 333 chars]- An application copies or implements the documented
- Remediation
View remediation
Remediation Suggestions
- Require
session_idto conform to a strict allowlist, preferably a canonical UUID or a similarly constrained identifier. - Reject absolute paths,
.., directory separators, NUL characters, and unexpected filename characters. - Resolve the base directory and candidate destination, then verify containment before writing.
- Create the session directory with restrictive permissions and run the application under a least-privileged account.
- Add tests covering parent traversal, absolute paths, nested separators, encoded traversal variants, and valid identifiers.
Example hardened implementation:
python import re from pathlib import Path SESSION_ID = re.compile(r"^[A-Za-z0-9_-]{1,128}$") def write_session(session_dir: Path, session_id: str, data: dict) -> None: if not SESSION_ID.fullmatch(session_id): raise ValueError("Invalid session identifier") base = session_dir.resolve() target = (base / f"{session_id}.json").resolve() if target.parent != base: raise ValueError("Session path escapes the storage directory") write_atomic_json(target, data)- Require