T09 · Insecure Skill Coding Practices
Error
- Location
operations/cleaner.py:66- Finding
Arbitrary Recursive Directory Deletion Without Enforced Authorization or Confirmation
- Content
View full analysis
dict[str, Any]: """ Clean a directory. Args: path: Directory path to clean dry_run: If True, only preview what would be deleted Returns: Clean result with space that would be freed """ result = cleaner.clean(path, dry_run=dry_run) return result.to_dict() ``` ```python # operations/cleaner.py:25-33 self.protected_paths = set() if protected_paths: for p in protected_paths: self.protected_paths.add(str(Path(p).expanduser().resolve())) # Add default protected paths home = str(Path.home().resolve()) self.protected_paths.add(home) self.protected_paths.add(os.path.join(home, "Documents")) self.protected_paths.add(os.path.join(home, "Desktop")) ``` ```python # operations/cleaner.py:66-120 path_obj = Path(path).expanduser().resolve() path_str = str(path_obj) # Check if path exists if not path_obj.exists(): return CleanResult( success=False, path=path_str, error="Path does not exist", dry_run=dry_run, ) # Check if protected if self.is_protected(path_str): return CleanResult( success=False, path=path_str, error="Path is protected and cannot be deleted", dry_run=dry_run, ) # Get size before deletion size = self.get_size(path_str) if dry_run: return CleanResult( success=True, path=path_str, freed_bytes=size, dry_run=True, ) # Perform deletion try: if keep_root: # Delete contents but keep directory for item in path_obj.iterdir(): if item.is_dir(): shutil.rmtree(item) ...[truncated 2981 chars]- Remediation
View remediation