T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
tools/parse_data.py:13- Finding
Unrestricted Local Spreadsheet Access Through Caller-Controlled Paths
- Content
View full analysis
pd.DataFrame: if not os.path.exists(file_path): raise FileNotFoundError(f"File not found: {file_path}") ext = os.path.splitext(file_path)[1].lower() try: if ext == ".csv": return pd.read_csv(file_path) elif ext in (".xlsx", ".xls"): return pd.read_excel(file_path) else: raise ValueError(f"Unsupported file format: {ext}") except Exception as e: raise ValueError(f"Failed to read {file_path}: {e}") ``` `tools/spc_analyze.py:276-282`: ```python file_path = data_schema.get("_file_path") if file_path: df = pd.read_csv(file_path) if file_path.endswith(".csv") else pd.read_excel(file_path) else: return {"error": "Cannot access original data file. Provide _file_path in data_schema."} values = pd.to_numeric(df[column], errors="coerce").dropna().values ``` `tools/reliability_analyze.py:239-246`: ```python def qc_reliability_analyze(data_schema: dict, time_column: str, censor_column: str, distribution: str = "auto") -> dict: file_path = data_schema.get("_file_path") if not file_path: return {"error": "Cannot access original data file. Provide _file_path in data_schema."} df = pd.read_csv(file_path) if file_path.endswith(".csv") else pd.read_excel(file_path) ``` ### Technical Analysis The MCP interface accepts caller-controlled filesystem paths without canonicalization, directory confinement, authorization checks, or an approved-file registry. The parser only verifies that the path exists and has a supported extension. The downstrea ...[truncated 2637 chars]- Remediation
View remediation