T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/list_openapi_meta_apis.py:29
- Finding
- Unsanitized API Identifiers Can Escape the Intended Output Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/list_openapi_meta_apis.py`, lines 29–31 and 59–60 **Vulnerability Type**: Path traversal through user-controlled filename components **Risk Level**: Low ### Vulnerable Code ```python parser.add_argument("--product-code", default=DEFAULT_PRODUCT_CODE) parser.add_argument("--version", default=DEFAULT_VERSION) parser.add_argument("--output-dir", default=str(OUTPUT_DIR)) ``` ```python json_file = output_dir / f"{args.product_code}_{args.version}_api_docs.json" md_file = output_dir / f"{args.product_code}_{args.version}_api_list.md" ``` ### Technical Analysis The `--product-code` and `--version` arguments are incorporated directly into output filenames without validation. Python's `pathlib` does not automatically prevent filename components containing path separators or `..` traversal components from resolving outside the intended output directory. Although the default values are safe, a caller can supply crafted values containing traversal sequences. The script subsequently writes the downloaded JSON metadata and generated Markdown content to the resulting paths. Exploitation is constrained because the same argument values are also inserted into the Alibaba Cloud metadata URL, and the network request must return valid JSON before the write operations occur. Nevertheless, the code does not enforce the documented boundary of `output/aliyun-cloudfw-manage/`, so a successful response for crafted identifiers could result in an out-of-directory write. The separately flagged credential behavior does not constitute a confirmed vulnerability. `SKILL.md` documents standard Alibaba Cloud credential sources, but this script does not read those credentials or include them in its HTTPS request. It contacts only the documented `api.aliyun.com` metadata endpoint. ### Attack Path 1. An attacker or untrusted workflow controls the arguments passed to the script. 2. The attacker supplies a `--product-code` or `- ...[truncated 1192 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate `--product-code` and `--version` against a strict allowlist before using them in URLs or filenames. For example, permit only letters, digits, periods, underscores, and hyphens: ```python import re SAFE_IDENTIFIER = re.compile(r"^[A-Za-z0-9._-]+$") for label, value in ( ("product-code", args.product_code), ("version", args.version), ): if not SAFE_IDENTIFIER.fullmatch(value) or value in {".", ".."}: parser.error(f"Invalid {label}: only safe identifier characters are allowed") ``` 2. Resolve each destination and verify that it remains beneath the resolved output directory: ```python output_root = output_dir.resolve() json_file = (output_root / f"{args.product_code}_{args.version}_api_docs.json").resolve() md_file = (output_root / f"{args.product_code}_{args.version}_api_list.md").resolve() for destination in (json_file, md_file): if not destination.is_relative_to(output_root): raise ValueError(f"Output path escapes output directory: {destination}") ``` 3. Apply the same validation before constructing the URL, or URL-encode each path segment with a strict safe-character policy. 4. Consider refusing absolute output paths unless explicitly required. If custom output directories are supported intentionally, document that they determine the write boundary. 5. Add regression tests covering `../`, absolute paths, embedded separators, encoded separators, empty identifiers, and valid Cloud Firewall product/version values. ]]>