T09 · Insecure Skill Coding Practices
Error
- Location
references/advanced_features.md:115- Finding
OBS Object Keys Can Escape the Intended Download Directory
- Content
View full analysis
{local_file_path}") if download_file(obs_client, bucket_name, object_key, local_file_path): ``` ### Technical Analysis The folder-download implementation derives a local destination directly from an OBS object key. Object keys are remote data and may be controlled by any principal with permission to create or rename objects in the selected bucket. Removing leading `/` characters does not remove `..` path components. Consequently, a key such as `shared/../../app/config.py`, when processed with `obs_prefix='shared/'`, produces the relative path `../../app/config.py`. Passing that value to `os.path.join()` allows the resulting path to resolve outside `local_folder_path`. The implementation then creates the destination's parent directories and calls the download function without verifying that the canonical destination remains inside the intended download root. It also does not require confirmation before overwriting an existing destination. ### Attack Path 1. An attacker obtains permission to upload or rename objects under a bucket or prefix processed by the victim. 2. The attacker creates an object with a traversal key, such as `shared/../../.ssh/authorized_keys`. 3. The victim calls `download_folder()` with `obs_prefix='shared/'` and a local download directory. 4. Prefix removal produces `../../.ssh/authorized_keys`. 5. `os.path.join() ...[truncated 829 chars]- Remediation
View remediation