T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/i2i_workflow.py:125
- Finding
- Unrestricted Local File Upload to External Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/i2i_workflow.py`, lines 125–153 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```python def upload_image(file_path: str, api_key: str = None) -> str: """上传图片并返回 URL""" if not api_key: api_key = get_api_key() file_path = Path(file_path).resolve() if not file_path.exists(): print(f"❌ 文件不存在: {file_path}") sys.exit(1) file_name = file_path.name print(f"📁 上传图片: {file_name}") # 获取上传凭证 upload_params = get_upload_token(file_name, api_key) # 上传到 OSS if not upload_to_oss( region=upload_params["region"], endpoint=upload_params["endpoint"], bucket=upload_params["bucket"], object_key=upload_params["object_key"], file_path=str(file_path), access_key_id=upload_params["access_key_id"], access_key_secret=upload_params["access_key_secret"], security_token=upload_params["security_token"], ): sys.exit(1) ``` ### Technical Analysis The image-to-image workflow legitimately requires uploading a user-selected image. However, the implementation only verifies that the resolved path exists. It does not verify that the path: - Refers to a regular file. - Contains a valid image. - Has an approved image format. - Is within an expected user-controlled directory. - Is below a safe size limit. - Is not a symbolic link to a sensitive file. As a result, the `--image` argument can identify any locally readable filesystem object accepted by the OSS client. Sensitive files such as environment files, SSH private keys, cloud credentials, application configuration, or agent state could therefore be sent to external BizyAir-provided Alibaba OSS storage. This exceeds the minimum filesystem privileges necessary for the declared image-to-image functionality. ### Attack Path 1. An attacker supplies a request that presents a sensitive local ...[truncated 1260 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Apply defense-in-depth validation before requesting upload credentials or transmitting data: 1. Require `file_path.is_file()` rather than checking only `exists()`. 2. Allowlist supported extensions such as `.jpg`, `.jpeg`, `.png`, and `.webp`. 3. Decode the file with a trusted image library and reject content that is not a valid supported image. Do not rely only on extensions or MIME names. 4. Set maximum decoded dimensions and file-size limits to prevent unintended large uploads and image decompression attacks. 5. Decide on an explicit symlink policy. Prefer rejecting symlinks and verifying the final resolved path. 6. Restrict uploads to user-approved directories or files explicitly attached to the current request. 7. Display the resolved path, detected image type, and destination service, then obtain explicit user confirmation before upload. 8. Avoid presenting the returned resource URL as public unless its access characteristics and retention policy are known. 9. Document BizyAir/OSS retention, deletion, and privacy implications. 10. Add automated tests proving that credential files, directories, symlinks, malformed images, and oversized files are rejected. ]]>