T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-html.py:68- Finding
Arbitrary File Write Through Unrestricted Output Filename
- Content
View full analysis
- Remediation
View remediation
Path: candidate_name = Path(filename) if candidate_name.is_absolute(): raise ValueError("Absolute output paths are not permitted") if ".." in candidate_name.parts: raise ValueError("Parent-directory traversal is not permitted") if candidate_name.suffix.lower() != ".html": raise ValueError("Output files must use the .html extension") base = output_dir.resolve() candidate = (base / candidate_name).resolve() if not candidate.is_relative_to(base): raise ValueError("Output path escapes the configured output directory") return candidate ``` 3. Use the validated path for every page-generation method: ```python output_path = validate_output_filename(self.output_dir, output_filename) output_path.write_text(html_content, encoding="utf-8") ``` 4. Consider refusing to overwrite existing files unless the caller provides an explicit overwrite option: ```python with output_path.open("x", encoding="utf-8") as output_file: output_file.write(html_content) ``` 5. If overwrites are required, verify that the destination is a regular file under the approved directory and is not a symbolic link. 6. Run the generator with a minimally privileged account and never as an administrator or root user. 7. Add automated tests covering absolute paths, nested traversal, symbolic-link escapes, alternate extensions, and valid nested output paths. ]]>