T09 · Insecure Skill Coding Practices
Warning
- Location
analyze_stock.py:58- Finding
Unsanitized Stock Symbol Permits Cache Path Traversal and Glob Injection
- Content
View full analysis
str | None: """在缓存目录中查找已有的数据文件，优先选最新的。""" candidates = [] for cache_dir in CACHE_DIRS: pattern = os.path.join(cache_dir, f"{symbol}-YFin-data-*.csv") candidates.extend(glob.glob(pattern)) if not candidates: return None candidates.sort(key=os.path.getmtime, reverse=True) return candidates[0] ``` ```python def _save_cache(data: pd.DataFrame, symbol: str, start_date, curr_date: str): """保存数据到缓存目录。""" try: cache_dir = CACHE_DIRS[0] os.makedirs(cache_dir, exist_ok=True) start_str = start_date.strftime("%Y-%m-%d") if hasattr(start_date, "strftime") else str(start_date)[:10] cache_file = os.path.join(cache_dir, f"{symbol}-YFin-data-{start_str}-{curr_date}.csv") data.to_csv(cache_file, index=False) except Exception: pass ``` ```python symbol = args.symbol.upper() ``` ### Technical Analysis The positional `symbol` argument is controlled by the command-line caller. The application only converts it to uppercase and does not validate it against an allowed stock-symbol syntax. The resulting value is embedded directly in two security-sensitive filesystem operations: 1. `_find_cached_file()` incorporates it into a `glob.glob()` pattern. 2. `_save_cache()` incorporates it into a cache output path. Uppercasing does not remove directory separators, `..` path components, absolute-path prefixes, or glob metacharacters such as `*`, `?`, and character classes. A crafted symbol can therefore alter the intended path or glob pattern instead of being treated as an ordinary filename component. The cache lookup is particularly exposed because traversal and wildcard syntax can make the search inspect matching CSV fi ...[truncated 2506 chars]- Remediation
View remediation