T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_shopee_sbs_common.py:217- Finding
Unsanitized SESSION_ID Allows Output Path Traversal
- Content
View full analysis
str: env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _LF_SESSION_CACHE: _LF_SESSION_CACHE["_auto"] = ( _lf_time.strftime("%H%M%S", _lf_time.localtime(ts)) + "-" + _lf_secrets.token_hex(3) ) return _LF_SESSION_CACHE["_auto"] ``` The returned value is subsequently used directly in a filesystem path: ```python sid = _lf_session_id(ts) root = _lf_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _lf_ensure_meta(root, session_dir, date_str, sid, ts) data_dir = os.path.join(session_dir, "data") os.makedirs(data_dir, exist_ok=True) out = os.path.join(data_dir, f"{slug}-{int(ts * 1_000_000)}.json") try: with open(out, "w", encoding="utf-8") as f: f.write(serialized) ``` The onboarding implementation repeats the same unsafe pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis `SESSION_ID` is read from the process environment and treated as a trusted directory name. No validation rejects absolute paths, path separators, `.` components, or `..` traversal components. With `os.path.join`, an absolute `SESSION_ID` can discard the previously constructed root and date components. A relative value containing traversal components can escape the intended session hierarchy after path normalization. T ...[truncated 1497 chars]- Remediation
View remediation
str: value = value.strip() if not _SESSION_ID_PATTERN.fullmatch(value): raise ValueError("Invalid SESSION_ID") return value ``` 3. Explicitly reject absolute paths, `/`, `\`, `.` and `..` path components. 4. Resolve the final path and verify containment before creating or writing files: ```python root_path = Path(root).resolve() session_path = (root_path / date_str / validated_sid).resolve() session_path.relative_to(root_path) ``` 5. Apply the same validation in both `_shopee_sbs_common.py` and `onboarding.py`. 6. Add tests for Unix and Windows absolute paths, nested traversal, mixed separators, empty values, and encoded or unusual path characters. ]]>