T09 · Insecure Skill Coding Practices
Error
- Location
PineScript工具包.js:484- Finding
Path Traversal Enables Arbitrary File Creation and Overwrite
- Content
View full analysis
- Remediation
View remediation
100 || !/^[\p{L}\p{N} _-]+$/u.test(projectName) || projectName === "." || projectName === ".." ) { throw new Error("Invalid project name"); } return projectName; } const safeName = validateProjectName(项目名称); const projectRoot = path.resolve(this.项目目录); const projectPath = path.resolve(projectRoot, safeName); if ( projectPath === projectRoot || !projectPath.startsWith(projectRoot + path.sep) ) { throw new Error("Project path escapes the permitted directory"); } ``` 3. **Sanitize the filename separately.** Do not assume that validation of a directory name automatically makes it safe for use as a filename. Derive the Pine Script filename from the validated basename and verify its resolved path independently. 4. **Prevent unintended overwrites.** Use exclusive creation where appropriate: ```javascript fs.writeFileSync(filePath, content, { flag: "wx" }); ``` If overwrite support is required, require an explicit trusted option and clearly report every file that will be replaced. 5. **Verify every write target.** Before each `mkdirSync()` or `writeFileSync()` call, confirm that the resolved path remains within the expected project directory. 6. **Run with least privilege.** The toolkit should not run as an administrator or privileged service account. Restrict filesystem permiss ...[truncated 329 chars]