T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apply_zh.py:281- Finding
Custom Dictionary Filenames Permit Arbitrary File Read and Overwrite
- Content
View full analysis
3 else "renderer.js" ``` ```python written = [] for fname, content in working.items(): has_bom = files[fname][1] out_path = os.path.join(output_dir, fname) write_js_file(out_path, content, has_bom) written.append(out_path) ``` ```python files = {} for fname in file_names: path = os.path.join(src_base, fname) if os.path.exists(path): content, has_bom = read_js_file(path) files[fname] = (content, has_bom) else: print(f"[WARN] Source file does not exist: {fname}") ``` ### Technical Analysis The fourth field of each dictionary entry controls `src_file`. This value is accepted without validating that it is a simple filename or that its resolved path remains inside the GitHub Desktop source and output directories. For an absolute `src_file`, `os.path.join(src_base, fname)` and `os.path.join(output_dir, fname)` discard the trusted base directory and resolve to the attacker-supplied path. Relative values containing parent-directory components can similarly escape the intended directory. If the resulting path exists and contains UTF-8 data, `_load_source_files` reads it and adds it to the working file map. `apply_translations` can subsequently write translated content back to the same external path. This write occurs even when `--deploy` is not supplied; deployment controls copying into GitHub Desktop, not creation of translation output. ### Attack Path 1. An attacker creates a custom dictionary whose fourth field contains an absolute path or a traversal path such as `../../target.js`. 2. The attacker persuades the user or agent to invoke the documented `--dict` option with that dictionary. 3. `load_dict` accepts the untru ...[truncated 977 chars]- Remediation
View remediation