T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_customer.py:52- Finding
Path Traversal Enables Unauthorized YAML File Access and Modification
- Content
View full analysis
- Remediation
View remediation
Path: if not isinstance(name, str) or not name.strip(): raise ValueError("Customer name must not be empty") if name in {".", ".."}: raise ValueError("Invalid customer name") if "/" in name or "\\" in name or "\x00" in name: raise ValueError("Customer name contains prohibited characters") target = (CUSTOMER_DIR / f"{name}.yaml").resolve() if target.parent != CUSTOMER_DIR: raise ValueError("Customer path escapes the customer directory") return target ``` 2. **Use opaque storage identifiers** Prefer a generated UUID or another strictly validated identifier as the filename. Store the human-readable customer name only inside the YAML document. This avoids treating display data as a path component. 3. **Validate names at all entry points** Apply a conservative allowlist and length limit. If international names are required, permit Unicode letters, spaces, hyphens, and selected punctuation while explicitly rejecting path separators, traversal components, absolute paths, null bytes, and control characters. 4. **Verify containment after canonicalization** Input filtering alone is insufficient. Resolve the base and candidate paths and verify that the target is an immediate child of the customer directory before every read, creation, or write. 5. **Use atomic, non-following writes where practical** Write to a safely created temporary file inside the customer directory and atomically replace the intended record. Consider protections against symbolic-link attacks if the customer directory can be modified by less-trusted local users. 6 ...[truncated 637 chars]