T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rename-files.js:19- Finding
Path Traversal in User-Controlled Rename Prefix Allows Files to Be Moved Outside the Selected Directory
- Content
View full analysis
name unchanged`); continue; } const oldPath = path.join(dirPath, oldName); const newPath = path.join(dirPath, newName); // Check if target already exists if (fs.existsSync(newPath)) { console.error(`Error: Cannot rename "${oldName}" -> "${newName}" (file already exists)`); continue; } operations.push({ oldPath, newPath, oldName, newName }); } ``` The resulting destination is subsequently used in a filesystem rename operation: ```js for (const op of operations) { try { fs.renameSync(op.oldPath, op.newPath); console.log(`✓ ${op.oldName} -> ${op.newName}`); results.success++; ``` ### Technical Analysis The script treats the user-supplied prefix as a filename component, but it does not reject path separators or traversal components such as `../`. Consequently, `newName` can represent a relative path rather than a filename. For example, given a selected directory `/data/photos`, an existing sibling directory `/data/archive`, and the following prefix: ```text ../archive/backup_ ``` A source file named `image.jpg` produces: ```text newName = ../archive/backup_image.jpg newPath = ...[truncated 2242 chars]- Remediation
View remediation