T09 · Insecure Skill Coding Practices
Warning
- Location
- analyze_image.py:111
- Finding
- Predictable Shared Temporary File Allows File Overwrite and Race Conditions<![CDATA[ ## Vulnerability Details **File Location**: `analyze_image.py`, lines 111–140 and 244–247 **Vulnerability Type**: Predictable temporary file creation and unsafe shared-file handling **Risk Level**: Medium ### Vulnerable Code ```python # Create temporary file temp_dir = tempfile.gettempdir() temp_path = os.path.join(temp_dir, f"compressed_{os.path.basename(image_path)}") # Try different compression strategies # Strategy 1: Reduce quality quality = 95 while quality >= 30: img.save(temp_path, 'JPEG', quality=quality, optimize=True) if os.path.getsize(temp_path) <= max_size_bytes: compressed_size = os.path.getsize(temp_path) print(f"Compression complete: {original_size / 1024 / 1024:.2f}MB → {compressed_size / 1024 / 1024:.2f}MB (quality: {quality}%)") return temp_path, True quality -= 10 # Strategy 2: Reduce dimensions if lowering quality is insufficient scale = 0.9 while scale > 0.3: new_width = int(width * scale) new_height = int(height * scale) resized_img = img.resize((new_width, new_height), Image.Resampling.LANCZOS) resized_img.save(temp_path, 'JPEG', quality=85, optimize=True) if os.path.getsize(temp_path) <= max_size_bytes: compressed_size = os.path.getsize(temp_path) print(f"Compression complete: {original_size / 1024 / 1024:.2f}MB → {compressed_size / 1024 / 1024:.2f}MB (dimensions: {scale*100:.0f}%)") return temp_path, True scale -= 0.1 ``` The corresponding cleanup code is: ```python finally: # Clean up temporary file if temp_file and os.path.exists(temp_file): try: os.remove(temp_file) except: pass ``` ### Technical Analysis The compressed image path is constructed deterministically from the basename of the source image: ```python compressed_<source basename> ``` The file is placed in the operating system's shared temporary directory. The application does not use an atomic, exclusive file-creation op ...[truncated 3268 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the predictable path with a securely and uniquely created temporary file: ```python fd, temp_path = tempfile.mkstemp(prefix="ollama_image_", suffix=".jpg") os.close(fd) ``` Alternatively, use `tempfile.NamedTemporaryFile(delete=False, suffix=".jpg")` and retain the generated path. 2. Ensure the temporary file is created atomically by the application rather than generating a name and opening it later. 3. Use a private temporary directory with restrictive permissions when processing potentially sensitive images: ```python temp_dir = tempfile.mkdtemp(prefix="ollama_vision_") temp_path = os.path.join(temp_dir, "compressed.jpg") ``` 4. Track the exact file and directory created by the current invocation. Remove only those resources during cleanup, preferably with `shutil.rmtree(temp_dir)` after validating that `temp_dir` is the private directory returned by `mkdtemp()`. 5. Minimize time-of-check/time-of-use windows. Avoid repeatedly resolving a shared pathname across save, size-check, encoding, and deletion operations where practical. 6. Add concurrency tests that analyze multiple images with identical basenames and verify that each invocation receives a unique temporary path. 7. Add platform-specific tests for symbolic links, junctions, and other path-redirection mechanisms supported by the deployment environment. ]]>