T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract_contract_dates_v2.py:155- Finding
Predictable Files in a Shared Temporary Directory Permit Symlink Overwrites and Path Manipulation
- Content
View full analysis
bool: """Download a PDF file.""" url = f"https://962121.fgj.sh.gov.cn/wyweb//web/UploadFiles/pdf/{pdf_id}.pdf" try: response = requests.get(url, timeout=30) if response.status_code == 200: with open(output_path, 'wb') as f: f.write(response.content) ``` ```python def process_project(project_name: str, output_dir: str = '/tmp') -> dict: """Process a single project.""" print(f"\nProcessing: {project_name}") announcements = search_project_announcements(project_name) # ... for ann in announcements['招标公告'][:1]: pdf_path = f"{output_dir}/{project_name}_招标_{ann['pdf_id']}.pdf" if download_pdf(ann['pdf_id'], pdf_path): text = ocr_pdf(pdf_path) # ... for ann in announcements['中标公告'][:1]: pdf_path = f"{output_dir}/{project_name}_中标_{ann['pdf_id']}.pdf" if download_pdf(ann['pdf_id'], pdf_path): text = ocr_pdf(pdf_path) ``` Equivalent predictable `/tmp` filename construction also appears in: - `scripts/batch_extract_dates.py:197, 218` - `scripts/batch_extract_dates_v2.py:206, 239` - `scripts/fetch_project.py:223` - `scripts/find_expiring_contracts_v4.py:225` - `scripts/find_expiring_contracts_v5.py:224` ### Technical Analysis The scripts construct filenames in the globally shared `/tmp` directory using project names and public PDF identifiers. They then open those paths with ordinary write-and-truncate semantics. There are no controls to: - Create a private per-run temporary directory. - Reject symbolic links. - Atomically create a previously nonexistent file. - Normalize and constrain the resolved path to the intended direct ...[truncated 2154 chars]- Remediation
View remediation