T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/save_comments.py:33- Finding
Path Traversal Through Unsanitized Output Filename Components
- Content
View full analysis
- Remediation
View remediation
str: value = str(value or fallback) value = re.sub(r'[^A-Za-z0-9._-]+', '_', value) value = value.strip(' ._')[:80] return value or fallback base = output_dir.resolve() blogger_name = safe_component( data.get('blogger', {}).get('name'), 'unknown' ) note_id = safe_component( data.get('note', {}).get('id'), 'unknown' ) filename = f"xhs_comments_{blogger_name}_{note_id}_{timestamp}.json" filepath = (base / filename).resolve() if filepath.parent != base: raise ValueError("Unsafe output path") ``` 6. If overwriting is unnecessary, use exclusive creation mode (`'x'`) or a securely generated unique suffix to prevent accidental truncation. 7. Validate the complete input structure and accepted field types before processing it. ]]>