T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bailian_faiss_kb.py:291- Finding
Symlink-Based Arbitrary File Read and External Disclosure
- Content
View full analysis
Path: expected_parent = kb_dir(kb_root, kb_name) doc_dir = doc_dir.resolve() if doc_dir.parent != expected_parent.resolve(): raise KBError(f"Document directory must be directly under {expected_parent}") return doc_dir ``` ```python def read_markdown_file(path: Path) -> str: return normalize_text(path.read_text(encoding="utf-8", errors="ignore")) ``` ```python for chunk_path in sorted(chunks_dir.glob("chunk-*.md")): chunk_id = parse_chunk_id(chunk_path) text = read_markdown_file(chunk_path) ``` ```python for question_path in sorted(t2q_dir.glob("*.md")): chunk_id, q_id = parse_t2q_name(question_path) if chunk_id not in chunk_lookup: raise KBError(f"T2Q file {question_path.name} references missing chunk {chunk_id}") text = collapse_text(question_path.read_text(encoding="utf-8", errors="ignore")) ``` ```python def embed_texts(texts: list[str], batch_size: int = 10) -> list[list[float]]: if not texts: return [] requests = load_requests() api_key = load_api_key() outputs: list[list[float]] = [] for start in range(0, len(texts), batch_size): batch = texts[start : start + batch_size] payload = { "model": EMBEDDING_MODEL, "input": batch, "dimensions": EMBEDDING_DIMENSIONS, "encoding_format": "float", } response = requests.post( EMBEDDING_URL, headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json=payload, timeout=120, ) ``` ### Technical Analysis The implementation resolves and validates the ...[truncated 3399 chars]- Remediation
View remediation