T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/list_openapi_meta_apis.py:31
- Finding
- Unsanitized CLI Arguments Permit Output Path Traversal## Vulnerability Details **File Location**: `scripts/list_openapi_meta_apis.py`, lines 31–58 **Vulnerability Type**: Path traversal / arbitrary file write outside the intended output directory **Risk Level**: Medium ```python parser.add_argument("--product-code", default=DEFAULT_PRODUCT_CODE) parser.add_argument("--version", default=DEFAULT_VERSION) parser.add_argument("--output-dir", default=str(OUTPUT_DIR)) args = parser.parse_args() timeout = int(os.getenv("OPENAPI_META_TIMEOUT", "20")) output_dir = pathlib.Path(args.output_dir) output_dir.mkdir(parents=True, exist_ok=True) url = ( f"https://api.aliyun.com/meta/v1/products/{args.product_code}" f"/versions/{args.version}/api-docs.json" ) payload = fetch_json(url, timeout) raw_apis = payload.get("apis", {}) if isinstance(raw_apis, dict): api_names = sorted(raw_apis.keys()) elif isinstance(raw_apis, list): names = [] for item in raw_apis: if isinstance(item, dict): name = item.get("name") or item.get("apiName") if name: names.append(name) elif isinstance(item, str): names.append(item) api_names = sorted(set(names)) else: api_names = [] json_file = output_dir / f"{args.product_code}_{args.version}_api_docs.json" md_file = output_dir / f"{args.product_code}_{args.version}_api_list.md" ``` ### Technical Analysis The `--product-code` and `--version` arguments are accepted as unrestricted strings. Both values are subsequently interpolated into output filenames and joined to the configured output directory using `pathlib.Path`. `pathlib` does not automatically confine a joined path to its intended parent directory. Consequently, path separators and parent-directory components such as `../` in either argument can cause the resulting path to resolve outside `output_dir`. The script later writes remote ...[truncated 2523 chars]
- Remediation
- ## Remediation Suggestions 1. Validate `--product-code` and `--version` before using them in URLs or filenames. Permit only the characters required by Alibaba Cloud identifiers, such as ASCII letters, digits, periods, underscores, and hyphens. 2. Explicitly reject absolute paths, path separators, empty values, and parent-directory components. 3. Separate URL identifiers from local filenames. Encode URL path segments with an appropriate URL-quoting function and independently convert identifiers into safe local filename components. 4. Resolve both the output directory and each destination path, then verify that every destination remains beneath the resolved output directory before writing. 5. Consider using fixed output filenames, such as `api_docs.json` and `api_list.md`, inside a validated product/version directory. 6. Avoid unintentionally replacing existing files by using exclusive creation where appropriate or requiring explicit confirmation before overwrite. 7. Add tests covering values such as parent-directory traversal sequences, absolute paths, embedded separators, URL metacharacters, and excessively long identifiers. 8. Retain the current fixed HTTPS destination and do not add credentials to the metadata request, because the documented metadata endpoint does not require authentication.