T09 · Insecure Skill Coding Practices
Error
- Location
scraper/scrape_fraft.py:119- Finding
Server-Controlled Filename Enables Arbitrary PDF File Write
- Content
View full analysis
Optional[Path]: output_dir.mkdir(parents=True, exist_ok=True) path = output_dir / item["filename"] if path.exists() and path.stat().st_size > 1024: return path backoff = max(config["request_delay_sec"], 1.0) for attempt in range(1, config["max_retries"] + 1): response = session.get(item["download_url"], timeout=60) if response.status_code == 429: wait_s = min(60, backoff * (2 ** (attempt - 1))) print(f"[WARN] 429 for {item['filename']}, retrying in {wait_s:.1f}s (attempt {attempt})") time.sleep(wait_s) continue response.raise_for_status() if "application/pdf" not in response.headers.get("Content-Type", "") and len(response.content) < 1024: return None with open(path, "wb") as f: f.write(response.content) return path ``` ### Technical Analysis The filename is obtained from the remote API through `row.get("file")`. The only enforced validation is that its lowercase representation ends with `.pdf`. Although `parse_filename()` applies a strict regular expression internally, a failed match does not reject the filename. It merely returns metadata containing null fields. The origi ...[truncated 2023 chars]- Remediation
View remediation