T09 · Insecure Skill Coding Practices
Error
- Location
scripts/newsletter.py:254- Finding
Arbitrary JSON File Modification Through Unsanitized Draft Identifier
- Content
View full analysis
bool: """Schedule newsletter for delivery.""" draft_file = self.drafts_dir / f"{draft_id}.json" if not draft_file.exists(): print(f"✗ Draft not found: {draft_id}") return False # Load draft newsletter_data = json.loads(draft_file.read_text()) # Parse send time if optimal: # Calculate optimal send time (9 AM in recipient timezone) send_dt = datetime.now().replace(hour=9, minute=0, second=0, microsecond=0) if send_dt < datetime.now(): send_dt += timedelta(days=1) else: send_dt = datetime.fromisoformat(send_time.replace('Z', '+00:00')) # Update draft newsletter_data['scheduled_at'] = send_dt.timestamp() newsletter_data['status'] = 'scheduled' draft_file.write_text(json.dumps(newsletter_data, indent=2)) ``` The same flaw is present in the sending operation: ```python def send(self, draft_id: str, test_email: Optional[str] = None, segment: Optional[str] = None, platform: Optional[str] = None) -> bool: """Send newsletter.""" draft_file = self.drafts_dir / f"{draft_id}.json" if not draft_file.exists(): print(f"✗ Draft not found: {draft_id}") return False newsletter_data = json.loads(draft_file.read_text()) platform = platform or newsletter_data.get('platform', 'substack') print(f"✓ Sending: {draft_id}") print(f" Platform: {platform}") if test_email: print(f" Test mode: sending to {test_email}") # In real implementation, would send test email else: print(f" Recipients: All subscribers") # In real ...[truncated 2245 chars]- Remediation
View remediation