T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/design_system.py:504- Finding
Path Traversal Permits File Creation or Overwrite Outside the Intended Design-System Directory
- Content
View full analysis
/`. The `project_name` input controls ...[truncated 2612 chars]- Remediation
View remediation
str: slug = value.strip().lower().replace(" ", "-") if not re.fullmatch(r"[a-z0-9_-]+", slug): raise ValueError(f"Invalid {field}") if slug in {".", ".."}: raise ValueError(f"Invalid {field}") return slug ``` 2. **Reject absolute paths and path components** Treat project and page values as logical names rather than paths. Explicitly reject values containing `/`, `\`, `Path.anchor`, or any `.`/`..` path component. 3. **Verify containment after canonicalization** Resolve the intended root and candidate destination, then ensure the destination remains beneath that root: ```python root = (base_dir / "design-system").resolve() project_slug = safe_slug(project_name, "project name") project_dir = (root / project_slug).resolve() if project_dir != root and root not in project_dir.parents: raise ValueError("Project path escapes design-system root") pages_dir = project_dir / "pages" page_slug = safe_slug(page, "page name") page_file = (pages_dir / f"{page_slug}.md").resolve() if pages_dir.resolve() not in page_file.parents: raise ValueError("Page path escapes pages directory") ``` 4. **Constrain `output_dir` where the execution environment requires it** If persistence should be limited to the current workspace, resolve `output_dir` and verify that it is inside the approved workspace root. Do not accept arbitrary absolute output directories by default. 5. **Mitigate symbolic-link attacks** Validate resolved paths immediately before writing. In higher-risk environments, reject symlinked parent directories or use platform-supported no-follow and directory-relative file operations. 6. **Avoid silent overwrites** Use excl ...[truncated 518 chars]