T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/file_transfer.py:27- Finding
Unrestricted Local File Upload Violates the Intended Workspace Boundary
- Content
View full analysis
dict: """Upload one file to the Leap platform and return the result.""" body, content_type = _build_multipart(abs_path) url = f"{base_url}/api/v1/files/upload" req = urllib.request.Request(url, data=body, method="POST", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": content_type, "Accept": "application/json", }) try: with urllib.request.urlopen(req, timeout=120) as resp: return json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as e: body_text = e.read().decode("utf-8", "replace") return {"status": "error", "http_code": e.code, "error_message": body_text, "file_path": abs_path} except urllib.error.URLError as e: return {"status": "error", "error_message": f"Connection failed: {e}", "file_path": abs_path} def upload_files(base_url: str, api_key: str, file_paths: list): """Upload one or m ...[truncated 3161 chars]- Remediation
View remediation