T09 · Insecure Skill Coding Practices
Error
- Location
scaffold_code.py:13- Finding
Attacker-Controlled Path Traversal and Arbitrary File Overwrite
- Content
View full analysis
dict: """生成 PyTorch 代码骨架""" title = metadata.get('title', 'Model').replace(' ', '_').replace('-', '_') files = { f'{title}/README.md': f"""# {metadata.get('title', 'Paper Implementation')} Unofficial PyTorch implementation based on the paper. ## Setup ```bash pip install -r requirements.txt ``` ## Usage ```bash python train.py --config configs/default.yaml ``` ## Structure - `model.py` - Core model architecture - `train.py` - Training loop - `evaluate.py` - Evaluation script - `datasets/` - Dataset loaders - `configs/` - Configuration files """, f'{title}/requirements.txt': """torch>=2.0.0 torchvision>=0.15.0 numpy>=1.24.0 pandas>=2.0.0 tqdm>=4.65.0 yaml>=6.0 """, f'{title}/model.py': f'''""" Core model architecture for {metadata.get("title", "Paper")} """ ... ''', f'{title}/train.py': '''""" Training loop for paper reproduction. """ ... ''', f'{title}/configs/default.yaml': f"""# Default configuration for {metadata.get('title', 'Model')} ... """, f'{title}/datasets/__init__.py': '''""" Dataset loaders. """ ... ''' } return files ``` The resulting paths are then written without containment validation or overwrite protection: ```python # 写入文件 output_dir = Path(args.output_dir) output_dir.mkdir(parents=True, exist_ok=True) for filepath, content in files.items(): full_path = output_dir / filepath full_path.parent.mkdir(parents=True, exist_ok=True) with open(full_path, 'w', encoding='utf-8') as f: f.write(content) print(f"Created: {full_pa ...[truncated 2585 chars]- Remediation
View remediation