T09 · Insecure Skill Coding Practices
Error
- Location
scripts/migrate.py:253- Finding
Arbitrary Local File Read Through Unvalidated Migrated Manifest Paths
- Content
View full analysis
bool: """Register a document.""" if not checksum: checksum = "" now = utcnow_str() self._conn.execute( """INSERT OR REPLACE INTO manifest (doc_id, rel_path, checksum, created_at, updated_at) VALUES (?, ?, ?, ?, ?)""", (doc_id, file_path, checksum, now, now), ) self._conn.commit() return True ``` Recall later constructs a path directly from the stored value, validates only that the same value exists in the manifest, and then reads the resulting file: ```python for doc_rel in docs: doc_path = os.path.join(base_dir, doc_rel) entry = manifest_store.get_by_path(doc_rel) if entry is None: checksum_statuses.append({ "doc": doc_rel, "status": "not_registered", }) continue if not os.path.isfile(doc_path): checksum_statuses.append({ "doc": doc_rel, ...[truncated 3776 chars]- Remediation
View remediation