T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/rename_channel.py:80- Finding
Workspace traversal follows symbolic links and can overwrite files outside the selected workspace
- Content
View full analysis
List[str]: """Search and update workspace files with new channel name.""" updated_files = [] # Patterns to replace patterns = [ (f"#{old_name}", f"#{new_name}"), # Channel mentions (f'"{old_name}"', f'"{new_name}"'), # Quoted references (f"/{old_name}/", f"/{new_name}/"), # Path-like references ] # Search all markdown files for md_file in workspace.rglob("*.md"): if md_file.is_file(): content = md_file.read_text() original_content = content # Apply all patterns for old_pattern, new_pattern in patterns: content = content.replace(old_pattern, new_pattern) # Write back if changed if content != original_content: md_file.write_text(content) updated_files.append(str(md_file.relative_to(workspace))) ``` ### Technical Analysis The function recursively searches every Markdown file beneath a user-supplied workspace and writes replacements directly to each matching file. It does not verify whether a candidate is a symbolic link or whether its resolved target remains within the selected workspace. `Path.is_file()`, `Path.read_text()`, and `Path.write_text()` follow symbolic links. Consequently, a path that appears to be inside the workspace can refer to a file elsewhere on the filesystem. If that external file contains one of the replacement patterns, the script writes through the symbolic link and modifies the external target. The function also applies broad textual replacements to every Markdown file rather than limiting ...[truncated 1828 chars]- Remediation
View remediation