T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_audio.py:47- Finding
Path Traversal Through Untrusted Sheet Indices Can Overwrite or Delete Files
- Content
View full analysis
- Remediation
View remediation
1_000_000: raise ValueError("Index is outside the permitted range") return index ``` 2. Generate filenames exclusively from validated numeric values. 3. Create a private temporary directory with `tempfile.TemporaryDirectory()` rather than writing directly under the shared `/tmp` directory. 4. Resolve the final path and verify that it remains under the intended temporary directory: ```python from pathlib import Path output_dir = Path(temp_dir).resolve() output_path = (output_dir / f"{start_idx}-{end_idx}.mp3").resolve() if output_dir not in output_path.parents: raise ValueError("Invalid output path") ``` 5. Before deletion, verify that the path is a regular file created during the current execution and remains inside the private temporary directory. 6. Reject index values containing separators, traversal components, control characters, or non-numeric content. ]]>