T09 · Insecure Skill Coding Practices
Error
- Location
generator.ts:301- Finding
Arbitrary File Write Through Unsanitized Generated Paths
- Content
View full analysis
0) { for (const componentName of requirements.components) { const componentContent = this.generateComponent(componentName, uiAnalysis); await fs.promises.writeFile( path.join(componentsDir, `${componentName}.tsx`), componentContent ); } } ``` ### Technical Analysis Page routes and component names extracted from the user-supplied requirements document are used to construct filesystem paths without validation. Node.js `path.join()` normalizes traversal segments such as `..`; it does not guarantee that the resulting path remains under the intended output directory. The code does not reject absolute paths, traversal components, path separators, symbolic-link escapes, or platform-specific path syntax. Consequently, an attacker who controls the requirements document can cause the generator to write outside `src/app` or `src/components`. This exceeds the minimum filesystem privileges needed to generate a project because the generator should only create files beneath the selected project root. ### Attack Path 1. An attacker supplies a requirements document containing a page route such as `. ...[truncated 1048 chars]- Remediation
View remediation