T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/workspace_setup.py:54- Finding
Path Traversal Through an Unvalidated Case Name Allows Writes Outside the Configured Workspace
- Content
View full analysis
- Remediation
View remediation
str: if not isinstance(case_name, str) or not SAFE_CASE_NAME.fullmatch(case_name): raise ValueError("Invalid case name") if case_name in {".", ".."}: raise ValueError("Invalid case name") return case_name ``` 2. **Enforce containment after canonicalization** Resolve both the base directory and candidate path, then verify that the candidate is a descendant of the configured case root. ```python def safe_case_path(cases_dir, case_name): safe_name = validate_case_name(case_name) root = Path(cases_dir).expanduser().resolve() candidate = (root / safe_name).resolve() try: candidate.relative_to(root) except ValueError: raise ValueError("Case path escapes the configured workspace") return candidate ``` Use this helper in both `create_case_directory()` and `step1_interview()`. 3. **Defend against symbolic-link traversal** Reject symbolic links in existing path components, or perform writes through directory file descriptors with no-follow semantics where supported. At minimum, revalidate the resolved parent immediately before each write. 4. **Create files without unintended overwrites** Where appropriate, use exclusive creation mode and fail safely if a target file already exists: ```python with case_data_path.open("x", encoding="utf-8") as handle: json.dump(case_data, handle, ensure_ascii=False, indent=2) ``` If updates are required, use an explicit, authenticated overw ...[truncated 560 chars]