T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/minimax_client.py:184- Finding
Unsanitized Project Name Allows Output-Directory Traversal
- Content
View full analysis
- Remediation
View remediation
str: if not project: raise ValueError("Project name cannot be empty") if Path(project).is_absolute(): raise ValueError("Absolute project paths are not allowed") if "/" in project or "\\" in project: raise ValueError("Project name must not contain path separators") if project in {".", ".."}: raise ValueError("Invalid project name") if not re.fullmatch(r"[A-Za-z0-9._-]+", project): raise ValueError("Project name contains unsupported characters") return project root = output_hub.expanduser().resolve() if project: project = validate_project(project) target_dir = (root / project / sub_folder).resolve() else: target_dir = (root / sub_folder).resolve() if target_dir != root and root not in target_dir.parents: raise ValueError("Output path escapes the configured output root") target_dir.mkdir(parents=True, exist_ok=True) ``` Where symbolic links inside the output tree are a concern, avoid following pre-existing symlinks or perform secure descriptor-based file creation appropriate to the target operating system. ]]>