T09 · Insecure Skill Coding Practices
Error
- Location
scripts/perform_ocr.py:70- Finding
Arbitrary Local Files Can Be Uploaded to the External OCR Service
- Content
View full analysis
Vulnerability Details
File Location:
scripts/perform_ocr.py, lines 70–113
Vulnerability Type: Insufficient input validation leading to unauthorized file disclosure
Risk Level: HighVulnerable Code
python try: filepath = args.image # Prepare image_url (support both local file paths and URLs) if filepath.startswith(("http://", "https://")): image_url = filepath else: if not os.path.exists(filepath): print(f"Error: Image file not found at {filepath}", file=sys.stderr) sys.exit(1) mime_type, _ = mimetypes.guess_type(filepath) mime_type = mime_type or "image/jpeg" with open(filepath, "rb") as f: base64_image = base64.b64encode(f.read()).decode('utf-8') image_url = f"data:{mime_type};base64,{base64_image}" response = client.chat.completions.create( messages=[ { "role": "system", "content": "You are a helpful and harmless assistant. You should think step-by-step." }, { "role": "user", "content": [ { "type": "image_url", "image_url": { "url": image_url } }, { "type": "text", "text": args.prompt } ] } ], model="PaddleOCR-VL-1.5", stream=False, max_tokens=512, temperature=0.7, top_p=1, extra_body={ "top_k": 1, }, frequency_penalty=0, )Technical Analysis
The
--imageargument is treated as either a URL or an arbitrary local file path. For local paths, the script checks only wh ...[truncated 2128 chars]- Remediation
View remediation
Remediation Suggestions
- Resolve the supplied path with
Path.resolve()and require it to be inside an explicitly approved image-input directory. - Require a regular file and reject directories, devices, sockets, and symbolic links. Where relevant, use race-resistant file opening to prevent time-of-check/time-of-use path substitution.
- Validate the actual file signature and decode the file with a trusted image library instead of trusting its extension.
- Permit only explicitly supported image formats and reject unknown content rather than defaulting it to
image/jpeg. - Enforce conservative file-size and image-dimension limits before reading or uploading data.
- Stream or size-check the input rather than loading an unrestricted file entirely into memory.
- Clearly disclose that selected images are transmitted to Gitee AI and require confirmation before uploading local data.
- If URL input is not essential, remove it. Otherwise, separately validate URL schemes, destinations, redirects, and network access policy.
- Resolve the supplied path with