T09 · Insecure Skill Coding Practices
Warning
- Location
- generalrecognition.py:20
- Finding
- Symlink Bypass Allows Unauthorized Local File Disclosure to External OCR Service<![CDATA[ ## Vulnerability Details **File Location**: `generalrecognition.py`, lines 20–104 **Vulnerability Type**: Insufficient path containment and file-type validation **Risk Level**: Medium ### Vulnerable Code ```python def _normalize_local_path(user_path: str, field: str) -> Dict[str, Any]: """ 规范化并限制本地文件路径，只允许在当前工作目录及其子目录内读取。 禁止绝对路径和目录穿越（包含 ..），避免被恶意提示利用读取任意系统文件。 """ if not user_path: return { "error": "invalid_param", "message": f"field '{field}' is empty", } if os.path.isabs(user_path): return { "error": "invalid_path", "message": f"Absolute path is not allowed for '{field}'", } norm = os.path.normpath(user_path) if norm.startswith("..") or norm == "..": return { "error": "invalid_path", "message": f"Path traversal is not allowed for '{field}'", } base = os.getcwd() full = os.path.join(base, norm) return {"error": None, "path": full, "relative": norm} def _build_pic_base64(req: Dict[str, Any]) -> Dict[str, Any]: """ 从请求中获取 base64 图片内容： - 若提供 pic 字段（base64 字符串），直接使用； - 若提供 path/image/file，则从本地文件读取并转为 base64。 """ pic = req.get("pic") if pic: return {"pic": str(pic), "error": None} path_raw = req.get("path") or req.get("image") or req.get("file") if not path_raw: return { "pic": None, "error": "Either 'pic' (base64) or 'path/image/file' is required", } safe = _normalize_local_path(str(path_raw).strip(), "path") if safe["error"]: return {"pic": None, "error": safe["message"]} path = safe["path"] if not os.path.isfile(path): return {"pic": None, "error": f"File not found: {safe['relative']}"} try: with open(path, "rb") as f: raw = f.read() except Exception as e: return {"pic": None, "error": f"Failed to read file: {e}"} try: ...[truncated 3744 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Resolve the working directory and candidate file to canonical paths before opening the file: ```python from pathlib import Path base = Path.cwd().resolve() candidate = (base / user_path).resolve(strict=True) try: candidate.relative_to(base) except ValueError: raise ValueError("File must remain inside the working directory") ``` 2. Reject symbolic links explicitly when they are unnecessary for the OCR workflow. Perform checks using safely opened file descriptors where possible to reduce time-of-check/time-of-use race conditions. 3. Verify that the target is a regular file and inspect its actual file signature rather than trusting its extension. Permit only the image formats supported by the OCR provider, such as JPEG and PNG. 4. Enforce a strict byte-size limit before loading the complete file into memory. Read no more than the configured maximum plus one byte and reject oversized input. 5. Keep the external endpoint fixed to the documented HTTPS origin and clearly notify users that selected image contents are transmitted to a third-party OCR provider. 6. Consider requiring the caller to provide a file through a dedicated attachment or sandbox mechanism instead of accepting arbitrary filesystem paths. 7. Add tests covering: - Absolute paths. - `..` traversal. - Symlinks to files outside the working directory. - Nested symlink chains. - Non-image regular files. - Oversized files. - Files replaced between validation and opening. ]]>