T09 · Insecure Skill Coding Practices
- Location
scripts/utils.py:46- Finding
Incorrect Boolean Parsing Causes Unintended Local Persistence of Search Results
- Content
View full analysis
Vulnerability Details
File Location:
scripts/utils.py:46, 1119
Vulnerability Type: Incorrect environment-variable boolean parsing
Risk Level: LowVulnerable Code
python GTS_SAVE_FILE = os.getenv("GTS_SAVE_FILE", False)The resulting value is later evaluated directly:
python if GTS_SAVE_FILE: if output: process_path = output if os.path.exists(process_path): return_message = "错误信息：文件已存在" return return_message else: extension = GTS_SAVE_EXTENSION process_dir = os.path.join(gangtise_workspace_path, method_name) if not os.path.exists(process_dir): os.makedirs(process_dir, exist_ok=True)Technical Analysis
Environment-variable values returned by
os.getenv()are strings when configured. In Python, every non-empty string is truthy, including"False","false", and"0".Consequently, an operator who explicitly configures
GTS_SAVE_FILE=Falsemay reasonably expect result persistence to be disabled, but the condition at line 1119 evaluates to true. The application then enters the save branch and writes retrieved search results to Markdown or JSON files under the Gangtise workspace.This behavior also conflicts with the status-reporting logic elsewhere in the same file, which recognizes only the exact string
"True"as enabled and describes other configured values as disabled.Attack Path
- A deployment manifest, shell profile, container configuration, or orchestration system sets
GTS_SAVE_FILE=False. - A search script imports
scripts/utils.py. os.getenv()returns the non-empty string"False".- A search request retrieves document metadata, summaries, or content from Gangtise.
format_response()evaluatesif GTS_SAVE_FILE:.- The string
"False"evaluates as true. - Retrieved results are written to the Gangtise workspace despite the operator's ...[truncated 1049 chars]
- A deployment manifest, shell profile, container configuration, or orchestration system sets
- Remediation
View remediation
Remediation Suggestions
Parse the environment variable into a real Boolean using a strict allowlist:
python GTS_SAVE_FILE = os.getenv("GTS_SAVE_FILE", "false").strip().lower() in { "1", "true", "yes", "on", }For stricter configuration handling, reject unrecognized values rather than silently interpreting them:
python raw_save_file = os.getenv("GTS_SAVE_FILE", "false").strip().lower() if raw_save_file not in {"1", "0", "true", "false", "yes", "no", "on", "off"}: raise ValueError("Invalid GTS_SAVE_FILE value") GTS_SAVE_FILE = raw_save_file in {"1", "true", "yes", "on"}Additional hardening should include:
- Use the parsed Boolean consistently in both operational and status-reporting logic.
- Add tests covering unset, empty, true, false, zero, and mixed-case values.
- Clearly document the directories where search results can be persisted.
- Create result files with restrictive permissions where supported.
- Avoid storing full document text unless the user explicitly requests persistence.
- Consider a retention or cleanup policy for saved result and usage files.