T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init_ai_project.py:540- Finding
Unvalidated Path Components Permit Filesystem Writes Outside the Intended Project
- Content
View full analysis
- Remediation
View remediation
str: if not SAFE_NAME.fullmatch(value): raise ValueError(f"Invalid {field}") return value ``` 2. Reject absolute paths and explicit `.` or `..` components for every logical name. 3. Resolve and verify every destination before writing: ```python def contained_path(root: str, *parts: str) -> str: root = os.path.realpath(root) candidate = os.path.realpath(os.path.join(root, *parts)) if os.path.commonpath([root, candidate]) != root: raise ValueError("Destination escapes the project root") return candidate ``` 4. Validate `--output` separately as the authorized parent directory, then require all generated paths to remain beneath it. 5. Before overwriting configuration files, use exclusive creation or require an explicit `--overwrite` option. Display the resolved destination and request confirmation when replacing existing files. 6. Check parent directories for symbolic links or securely open files relative to a trusted directory descriptor where the platform supports it. 7. Add tests for absolute paths, nested separators, parent traversal, symbolic links, empty names, and platform-specific path syntax. ]]>