T09 · Insecure Skill Coding Practices
Error
- Location
main.js:326- Finding
Actor-Controlled Fixture Path Enables Arbitrary Local JSON File Disclosure
- Content
View full analysis
0) { await Actor.pushData(incidents); } ``` `main.js:326-332` resolves and reads the path without enforcing an allowed directory: ```javascript async function loadFixtureIncidents(fixturePath) { const absolutePath = path.resolve(__dirname, fixturePath); const payload = JSON.parse(await readFile(absolutePath, 'utf8')); return payload.map((item, index) => ({ id: item.id || item.incident_id || `fixture-${index + 1}`, ...item, })); } ``` ### Technical Analysis `fixturePath` is controlled through actor input, but it is not restricted to `examples/` or to a predefined filename. `path.resolve(__dirname, fixturePath)` canonicalizes traversal sequences but does not prevent the resulting path from escaping the project directory. If the selected file is readable, valid JSON, and contains an array, each object is spread into the resulting incident collection. The collection is subsequently uploaded through `Actor.pushData()`. This turns a local path traversal flaw into a disclosure channel through the Apify dataset. The fallback can be deliberately reached by setting all three live-source flags to `false` while keepi ...[truncated 1597 chars]- Remediation
View remediation