T09 · Insecure Skill Coding Practices
Error
- Location
upload.py:22- Finding
Arbitrary Local File Upload May Cause Public Disclosure
- Content
View full analysis
Vulnerability Details
File Location:
upload.py, lines 22–31
Vulnerability Type: Missing file-type, path, and size validation before third-party upload
Risk Level: HighVulnerable Code
python if not os.path.exists(image_path): raise FileNotFoundError(f"图片文件不存在: {image_path}") with open(image_path, 'rb') as f: files = {'image': f} data = {} if cdn_domain: data['cdn_domain'] = cdn_domain response = requests.post(API_URL, files=files, data=data)Technical Analysis
The script accepts a caller-provided local path and verifies only that it exists. It does not confirm that the target is a regular image file before reading and transmitting its contents to
https://img.scdn.io/api/v1.php.In particular, the implementation does not:
- Decode the file with a trusted image library to verify its content.
- Restrict uploads to approved file formats or MIME types.
- Restrict file access to an approved directory.
- Reject symbolic links or other non-regular filesystem objects.
- Enforce a maximum file size.
- Require explicit confirmation before transmitting local data to a public third-party service.
This also conflicts with the operational guidance in
SKILL.md, which states that the file should be confirmed as an image before upload. Filename-extension checks alone would not adequately fix the issue because arbitrary files can be renamed with image extensions.Attack Path
- An attacker or untrusted prompt influences the image-path argument supplied to the skill.
- The supplied path identifies a readable sensitive local file, potentially directly or through a symbolic link.
os.path.exists()succeeds because no approved-root or image-content policy is enforced.- The script opens the file in binary mode.
- The complete contents are submitted to the fixed third-party upload API.
- If the service accepts the content, it retur ...[truncated 716 chars]
- Remediation
View remediation
Remediation Suggestions
- Permit uploads only from explicitly approved directories. Resolve paths with
realpath()and verify that the resolved path remains within an allowed root. - Require the target to be a regular file and reject symbolic links, directories, devices, sockets, and other special filesystem objects.
- Enforce a conservative maximum file size before opening or uploading the file.
- Decode and validate the file with a maintained image-processing library, allowlisting only required formats such as JPEG, PNG, or WebP.
- Re-encode validated images before upload where practical, removing embedded payloads and unnecessary metadata.
- Set the multipart MIME type from the validated image format rather than trusting the filename.
- Require explicit user confirmation that the selected file will be transferred to a public third-party service.
- Add a request timeout, call
response.raise_for_status(), and handle invalid or oversized JSON responses safely. - Treat and display the returned deletion URL as sensitive control information.
- Permit uploads only from explicitly approved directories. Resolve paths with