T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/normalize_starcore_family.py:91- Finding
Unvalidated Symbols Permit Filesystem Path Traversal
- Content
View full analysis
- Remediation
View remediation
str: symbol = value.strip().upper() if not SYMBOL_RE.fullmatch(symbol): raise ValueError(f"Invalid token symbol: {value!r}") return symbol ``` 2. Apply validation consistently to: - `--symbols` command-line input. - Symbols returned by the Clawnch API. - Keys loaded from receipt and summary JSON files. - Symbols embedded inside individual receipt records. 3. Add a resolved-path containment check immediately before every write: ```python root = state.resolve() destination = (root / f"{symbol}_clawnch_receipt.json").resolve() if root not in destination.parents: raise ValueError("Output path escapes the state directory") ``` 4. Apply the same containment check to bookmark output paths and reject absolute `--bookmark-dir` values if writes are required to remain under the workspace. 5. Reject conflicting symbol values between a receipt object's key and its internal `symbol` field. 6. Add regression tests using values such as `../TARGET`, `A/B`, `A\B`, absolute paths, empty strings, and excessively long symbols. ]]>