T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/list_openapi_meta_apis.py:31- Finding
Unsanitized CLI Arguments Permit Output Path Traversal
- Content
View full analysis
Vulnerability Details
File Location:
scripts/list_openapi_meta_apis.py, lines 31–58
Vulnerability Type: Path traversal / arbitrary file write outside the intended output directory
Risk Level: Mediumpython parser.add_argument("--product-code", default=DEFAULT_PRODUCT_CODE) parser.add_argument("--version", default=DEFAULT_VERSION) parser.add_argument("--output-dir", default=str(OUTPUT_DIR)) args = parser.parse_args() timeout = int(os.getenv("OPENAPI_META_TIMEOUT", "20")) output_dir = pathlib.Path(args.output_dir) output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout) raw_apis = payload.get("apis", {}) if isinstance(raw_apis, dict): api_names = sorted(raw_apis.keys()) elif isinstance(raw_apis, list): names = [] for item in raw_apis: if isinstance(item, dict): name = item.get("name") or item.get("apiName") if name: names.append(name) elif isinstance(item, str): names.append(item) api_names = sorted(set(names)) else: api_names = [] json_file = output_dir / f"{args.product_code}_{args.version}_api_docs.json" md_file = output_dir / f"{args.product_code}_{args.version}_api_list.md"Technical Analysis
The
--product-codeand--versionarguments are accepted as unrestricted strings. Both values are subsequently interpolated into output filenames and joined to the configured output directory usingpathlib.Path.pathlibdoes not automatically confine a joined path to its intended parent directory. Consequently, path separators and parent-directory components such as../in either argument can cause the resulting path to resolve outsideoutput_dir.The script later writes remote ...[truncated 2523 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate
--product-codeand--versionbefore using them in URLs or filenames. Permit only the characters required by Alibaba Cloud identifiers, such as ASCII letters, digits, periods, underscores, and hyphens. - Explicitly reject absolute paths, path separators, empty values, and parent-directory components.
- Separate URL identifiers from local filenames. Encode URL path segments with an appropriate URL-quoting function and independently convert identifiers into safe local filename components.
- Resolve both the output directory and each destination path, then verify that every destination remains beneath the resolved output directory before writing.
- Consider using fixed output filenames, such as
api_docs.jsonandapi_list.md, inside a validated product/version directory. - Avoid unintentionally replacing existing files by using exclusive creation where appropriate or requiring explicit confirmation before overwrite.
- Add tests covering values such as parent-directory traversal sequences, absolute paths, embedded separators, URL metacharacters, and excessively long identifiers.
- Retain the current fixed HTTPS destination and do not add credentials to the metadata request, because the documented metadata endpoint does not require authentication.
- Validate