T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clean_cache.py:289- Finding
Resolved symlink targets are recursively deleted instead of unlinking the symlink
- Content
View full analysis
str: try: real = os.path.realpath(os.path.abspath(path)) except Exception: real = os.path.abspath(path) real_norm = real.rstrip(os.sep).lower() if len(real_norm) == 2 and real_norm[1] == ":": raise RuntimeError(f"Refusing to delete drive root: {real}") low = real.lower() for bad in FORBIDDEN_PARTS: if bad in low: raise RuntimeError(f"Refusing to delete critical system path: {real}") if not any(_is_under(real_norm, r) for r in _allowed_roots_norm()): raise RuntimeError(f"Refusing to delete path outside allowed roots: {real}") return real ``` The runtime messages above are translated to English for report consistency; the path-validation logic is unchanged. ```python def collect(items, min_bytes): plan, rejected, busy = [], [], [] for it in items: try: safe = assert_safe(it["path"]) except RuntimeError as e: rejected.append((it["name"], str(e))) continue if it.get("guard") and process_running(it["guard"]): busy.append(it["name"]) continue size = dir_size(safe) if size < min_bytes: continue it = dict(it) it["path"], it["size"] = safe, size pla ...[truncated 2607 chars]- Remediation
View remediation