T09 · Insecure Skill Coding Practices
Error
- Location
scripts/upload_feed_document.py:32- Finding
Arbitrary Local File Exfiltration Through an Unrestricted Upload Destination
- Content
View full analysis
bytes: if params.get("filePath"): p = Path(str(params["filePath"]).expanduser()) if not p.is_file(): print(f"filePath not found: {p}", file=sys.stderr) sys.exit(1) return p.read_bytes() if params.get("contentBase64"): try: return base64.b64decode(str(params["contentBase64"])) except Exception as e: print(f"Invalid contentBase64: {e}", file=sys.stderr) sys.exit(1) if "content" in params: raw = params["content"] if isinstance(raw, str): return raw.encode("utf-8") print("content must be a string", file=sys.stderr) sys.exit(1) print("Provide one of: filePath, content, contentBase64", file=sys.stderr) sys.exit(1) def main() -> None: if len(sys.argv) < 2: print( "Usage: upload_feed_document.py ''\n" "Required: uploadUrl, contentType, and filePath | content | contentBase64", file=sys.stderr, ) sys.exit(1) try: params = json.loads(sys.argv[1]) except json.JSONDecodeError as e: print(f"Invalid JSON: {e}", file=sys.stderr) sys.exit(1) for f in ("uploadUrl", "contentType"): if f not in params: print(f"Missing required field: {f}", file=sys.stderr) sys.exit(1) upload_url = str(params["uploadUrl"]).strip() content_type = str(params["contentType"]).strip() payload = _load_bytes(params) req = Request( upload_url, data=payload, headers={"Content-Type": content_type}, method="PUT", ) out: dict = {"uploadUrl": upload_url, "bytesUploaded": len(payload)} try: ...[truncated 2425 chars]- Remediation
View remediation