T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload-files.py:119- Finding
Unvalidated Upload Destination Can Cause Local File Disclosure
- Content
View full analysis
This step is not an MCP call. An HTTP PUT request must be executed with curl. curl -X PUT \ -H "Content-Type: " \ --data-binary "@" \ "" ``` `scripts/upload-files.py:119-149`: ```python async def upload_file_async(self, upload_url: str, file_path: str, mime_type: str) -> bool: """Asynchronously upload a file to a presigned URL.""" if not HAS_AIOHTTP: loop = asyncio.get_event_loop() return await loop.run_in_executor( None, self.upload_file_sync, upload_url, file_path, mime_type ) loop = asyncio.get_event_loop() data = await loop.run_in_executor(None, Path(file_path).read_bytes) async with aiohttp.ClientSession() as session: headers = {'Content-Type': mime_type} async with session.put(upload_url, data=data, headers=headers) as response: return response.status in (200, 201) def upload_file_sync(self, upload_url: str, file_path: str, mime_type: str) -> bool: """Synchronously upload a file to a presigned URL.""" with open(file_path, 'rb') as f: data = f.read() headers = {'Content-Type': mime_type} response = requests.put(upload_url, data=data, headers=headers) return response.status_code in (200, 201) ``` The tests also construct sessions with unrestricted plaintext HTTP destinations, demonstrating that host and transport restrictions are not part of the expected behavior: ```python def make_session( name: str = "test.md", upload_url: str = "http://example.com/upload" ) -> Uplo ...[truncated 2984 chars]- Remediation
View remediation