T09 · Insecure Skill Coding Practices
Error
- Location
main.py:88- Finding
Channel-Controlled Directory Traversal in Download Destination
- Content
View full analysis
|]', "", clean_text).strip() ``` ### Technical Analysis Folder names are derived from Telegram message content, which can be controlled by a channel administrator or anyone otherwise able to publish messages in the selected channel. Although `sanitize_name()` removes path separators, it explicitly permits periods and does not reject the special path components `.` and `..`. Consequently, a message whose first nonempty line is `..` sets `current_folder` to `..`. The expression `os.path.jo ...[truncated 2304 chars]- Remediation
View remediation
Path: if folder in {"", ".", ".."}: raise ValueError("Invalid folder name") destination = (base / folder / filename).resolve() if not destination.is_relative_to(base): raise ValueError("Destination escapes the configured download directory") return destination ``` 4. Reject absolute paths and all path separators before path construction, even if the current sanitizer is expected to remove them. 5. Refuse to follow symbolic links in destination components. Where supported, use descriptor-based filesystem operations and no-follow flags to reduce time-of-check/time-of-use risks. 6. Use `mkdir(parents=True, exist_ok=True)` only after containment validation. 7. Avoid silently replacing existing files. Use exclusive file creation or generate a collision-safe filename. 8. Add tests for `..`, `.`, Unicode path edge cases, symbolic links, absolute paths, and nested traversal attempts. ]]>