T09 ยท Insecure Skill Coding Practices
Warning
- Location
lib/blayer_client.py:17- Finding
Unsanitized agent name permits SQLite writes outside the intended memory directory
- Content
View full analysis
None: """Ensure the B-layer schema exists.""" try: self.db_path.parent.mkdir(parents=True, exist_ok=True) conn = sqlite3.connect(str(self.db_path)) conn.executescript(self.SCHEMA_SQL) conn.commit() conn.close() logger.debug(f"Schema ensured at {self.db_path}") ``` ### Technical Analysis The command-line `--agent` value is used directly to construct the SQLite database path. The code neither restricts the agent value to a filename-safe identifier nor resolves the resulting path and verifies that it remains beneath `~/.openclaw/memory`. In `pathlib`, joining a base path with an absolute path discards the base path. Relative values containing `../` can also traverse outside the intended directory. The `.sqlite` suffix does not prevent traversal or use of an absolute destination. After constructing t ...[truncated 2073 chars]- Remediation
View remediation