T09 · Insecure Skill Coding Practices
Error
- Location
scripts/parse_vaudtax.py:130- Finding
Archive-Controlled Path Traversal During Attachment Extraction
- Content
View full analysis
_ so the name stays unique and readable. Works for PDFs, JPEG images, and PNG images. """ root, _ = open_vaudtax(vaudtax_path) index = {} for doc in root.findall(f".//{ns('documents')}"): key = text(doc, "key") if key: index[key] = text(doc, "filename") or key if keys == ["all"]: keys = list(index) outdir = Path(outdir) if outdir else Path(tempfile.mkdtemp(prefix="vaudtax_")) outdir.mkdir(parents=True, exist_ok=True) paths = [] with zipfile.ZipFile(vaudtax_path) as z: for key in keys: target = outdir / f"{key}_{index.get(key, key)}" with z.open(key) as src: target.write_bytes(src.read()) paths.append(target.resolve()) return paths ``` ### Technical Analysis The ZIP entry key and original filename are obtained from attacker-controlled XML metadata and incorporated directly into an output path. Neither value is restricted to a basename, validated against an allowlist, nor checked for path separators, absolute paths, or `..` components. `Path` path joining does not automatically confine a resulting path to `outdir`. A malicious attachment key containing traversal components can therefore produce a target path outside the intended temporary or user-selected extraction directory. The subsequent call to `target.resolve()` occurs only after the file has already been written and is not used to enforce containment. It ther ...[truncated 1275 chars]- Remediation
View remediation