T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/list_openapi_meta_apis.py:32- Finding
Path Traversal Through Unsanitized Output Filenames
- Content
View full analysis
- Remediation
View remediation
str: if not SAFE_IDENTIFIER.fullmatch(value): raise ValueError(f"Invalid {name}: only letters, digits, '.', '_', and '-' are allowed") return value ``` 2. Validate the arguments before using them in either URLs or filenames: ```python product_code = validate_identifier(args.product_code, "product code") version = validate_identifier(args.version, "version") ``` 3. Resolve each output destination and enforce containment beneath the resolved output directory: ```python output_root = pathlib.Path(args.output_dir).resolve() output_root.mkdir(parents=True, exist_ok=True) json_file = ( output_root / f"{product_code}_{version}_api_docs.json" ).resolve() md_file = ( output_root / f"{product_code}_{version}_api_list.md" ).resolve() for destination in (json_file, md_file): if output_root not in destination.parents: raise ValueError("Output path escapes the configured output directory") ``` 4. Consider rejecting path separators explicitly even when additional validation is present. 5. Add regression tests covering `../`, absolute paths, platform-specific separators, encoded separators, empty values, and unexpectedly long identifiers. 6. Run the Skill under an account with minimal filesystem permissions so that a validation failure cannot become a broader workspace overwrite. ]]>