T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/rename.py:109
- Finding
- Existing destination files can be overwritten without the force option## Vulnerability Details **File Location**: `scripts/rename.py`, lines 109-130 **Vulnerability Type**: Unsafe file replacement and incomplete conflict validation **Risk Level**: Medium **Vulnerable Code**: ```python # First, check for conflicts new_names = [r['new_img'] for r in renames] if len(new_names) != len(set(new_names)): print("Error: Duplicate filenames would be created") return # Rename files renamed_images = 0 renamed_annotations = 0 errors = [] for r in renames: old_path = Path(args.directory) / Path(r['old_img']).name new_path = Path(args.directory) / r['new_img'] try: # Handle overwrite if args.force and new_path.exists(): new_path.unlink() old_path.rename(new_path) renamed_images += 1 # Rename annotation if exists if r['old_ann'] and r['new_ann']: if args.force and r['new_ann'].exists(): r['new_ann'].unlink() r['old_ann'].rename(r['new_ann']) renamed_annotations += 1 ``` ### Technical Analysis The preflight check only determines whether multiple source images generate the same destination name. It does not determine whether a generated image or annotation destination already exists on disk. The existence checks are only used to explicitly delete destinations when `--force` is enabled. Without that option, the code still invokes `Path.rename()` against the destination. On platforms where the underlying rename operation replaces existing files, this can silently overwrite destination content despite the absence of explicit overwrite authorization. Conflict validation is also performed only for generated image names. Existing annotation destinations and duplicate generated annotation paths are not comprehensively validated. Because image and annotation changes are applied incrementally, a conflict or error encountered partway through processin ...[truncated 1112 chars]
- Remediation
- ## Remediation Suggestions - Resolve and validate every source and destination before making any filesystem changes. - Reject any existing destination unless `--force` was explicitly supplied. - Apply the same conflict checks to image and annotation destinations. - Detect duplicate generated annotation names in addition to duplicate image names. - Ensure that a destination which is also a source in the same batch is handled safely. - Use a two-phase rename process: first move all sources to unique temporary names within the same filesystem, then move them to their final destinations. - Record a complete transaction manifest before mutation and roll back all completed operations if any step fails. - When force mode is enabled, back up existing destination files rather than unlinking them immediately. - Use resolved-path containment checks to ensure all final destinations remain inside their intended directories.