T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dawn_audit.py:52- Finding
Path Traversal Enables Arbitrary JSON File Read and Write
- Content
View full analysis
/`. The forced `.json` suffix limits the target to paths ending in `.json`, but does not prevent access to sensitive JSON files elsewhere in the writable or readable filesystem. The write operation can overwrite an existing JSON file or create a new one wherever the process has write permission. The `--show` operation can print the contents of a traversed JSON file to standard output. ### Attack Path 1. An attacker obtains control over a value passed as `decision_id` to `record_decision`, or can invoke the script with a crafted `--show` argument. 2. The attacker supplies a traversal value such as `../../../some-directory/target`. 3. The program appends `.json`, producing a path similar to: `data/audit/20260916/../../../some-directory/target.json`. 4. Path resolution escapes the intended date-specific audit directory. 5. For `record_decision`, the target file is overwritt ...[truncated 636 chars]- Remediation
View remediation
str: if not SAFE_ID.fullmatch(value): raise ValueError("Invalid decision identifier") return value ``` 2. Reject absolute paths, path separators, `.` components, and `..` components. 3. Resolve the final path and verify that it remains beneath the expected directory: ```python base = _safe_path(today).resolve() target = (base / f"{validate_decision_id(decision_id)}.json").resolve() if base not in target.parents: raise ValueError("Path escapes audit directory") ``` 4. Apply the same validation to both `record_decision` and `--show`. 5. Use atomic file creation or replacement where state integrity matters. 6. Add tests for `../`, absolute paths, mixed separators, encoded separators, oversized identifiers, and valid identifiers. ]]>