T09 · Insecure Skill Coding Practices
Error
- Location
vinrecognition.py:30- Finding
Symbolic-Link Bypass Allows Unintended Local File Disclosure to an External API
- Content
View full analysis
Dict[str, Any]: """ 规范化并限制本地文件路径，只允许在当前工作目录及其子目录内读取。 禁止绝对路径和目录穿越（包含 ..），避免被恶意提示利用读取任意系统文件。 """ if not user_path: return { "error": "invalid_param", "message": f"field '{field}' is empty", } if os.path.isabs(user_path): return { "error": "invalid_path", "message": f"Absolute path is not allowed for '{field}'", } norm = os.path.normpath(user_path) if norm.startswith("..") or norm == "..": return { "error": "invalid_path", "message": f"Path traversal is not allowed for '{field}'", } base = os.getcwd() full = os.path.join(base, norm) return {"error": None, "path": full, "relative": norm} ``` ```python path = safe["path"] if not os.path.isfile(path): return {"pic": None, "error": f"File not found: {safe['relative']}"} try: with open(path, "rb") as f: raw = f.read() except Exception as e: return {"pic": None, "error": f"Failed to read file: {e}"} try: encoded = base64.b64encode(raw).decode("utf-8") except Exception as e: return {"pic": None, "error": f"Failed to base64-encode file: {e}"} ``` ```python result = _call_vin_api(appkey, pic_info["pic"]) print(json.dumps(result, ensure_ascii=False, indent=2)) ``` The encoded content is transmitted by `_call_vin_api` as follows: ```python VIN_RECOG_URL = "https://api.jisuapi.com/vinrecognition/recognize" def _call_vin_api(appkey: str, pic_base64: str) -> Dict[str, Any]: params = {"appkey": appkey} data = {"pic": pic_base64} try: resp = requests.post(VIN_RECOG_URL, params=params, da ...[truncated 2699 chars]- Remediation
View remediation