T09 · Insecure Skill Coding Practices
Error
- Location
tools/memory_apply.py:68- Finding
Path Traversal Through Unvalidated Student Identifier
- Content
View full analysis
cutoff_time: self.session_memories.append(memory) ``` ### Technical Analysis The `student_id` parameter is incorporated directly into filesystem paths without validation or canonical containment checks. Both profile loading and recent-memory loading are affected. In `_load_student_profile`, traversal components can cause the resulting filename to resolve outside the intended `profiles` directory. In `_load_recent_memories`, an absolute path or traversal sequence can redirect directory enumeration to another location accessible to the process. `os.path.join()` does not enforce containment. In particular, an absolute later component can replace the preceding base path, while `..` components remain effective when the operating system resolves the path. The only content restriction applied to enumerated me ...[truncated 1996 chars]- Remediation
View remediation
str: if not STUDENT_ID_PATTERN.fullmatch(student_id): raise ValueError("Invalid student identifier") return student_id ``` 2. Resolve and verify every generated path remains beneath its intended directory: ```python from pathlib import Path def safe_child(base: Path, *parts: str) -> Path: base = base.expanduser().resolve() candidate = base.joinpath(*parts).resolve() if candidate != base and base not in candidate.parents: raise ValueError("Path escapes the permitted directory") return candidate ``` 3. Apply separate containment checks for the `profiles` and `memories` directories. 4. Reject absolute identifiers, path separators, `.` components, and `..` components. 5. Catch `JSONDecodeError`, invalid timestamps, and filesystem errors without exposing sensitive paths. 6. Add authorization checks so a caller can access only the student record associated with its authenticated identity. 7. Add tests covering absolute paths, nested traversal, symbolic links, malformed JSON, and cross-student access. ]]>