T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build_index.py:205- Finding
Arbitrary Markdown File Overwrite Through Unsanitized Topic Slug
- Content
View full analysis
None: """Generate wiki/topics/.md.""" topics_dir = wiki_dir / "topics" topics_dir.mkdir(exist_ok=True) by_topic = defaultdict(list) for p in pages: by_topic[p["topic"]].append(p) # Remove old indexes for old in topics_dir.glob("*.md"): old.unlink() for slug, group in by_topic.items(): t = topics.get(slug, {}) name = t.get("name", slug) group.sort(key=lambda p: (ENTITY_ORDER.get(p["entity_type"], 99), p["title"])) by_type = defaultdict(list) for p in group: by_type[p["entity_type"] or "Other"].append(p) lines = [ f"", f"# {name}", "", f"Total pages: {len(group)}.", "", ] for et in sorted(by_type.keys(), key=lambda x: ENTITY_ORDER.get(x, 99)): lines.append(f"## {et}") for p in by_type[et]: summary = p["summary"] summary_str = f" — {summary}" if summary else "" lines.append(f"- [[{p['slug']}]] {p['title']}{summary_str}") lines.append("") (topics_dir / f"{slug}.md").write_text("\n".join(lines), encoding="utf-8") ``` ### Technical Analysis The `topic` value is read from page frontmatter and propagated into `p["topic"]`. It is then used as the `slug` component of an output path without validating that it is a single, safe kebab-case identifier. The expression: ```python topics_dir / f"{slug}.md" ``` does not guarantee that the resulting path remains under `wiki/topics`. A topic containing parent-directory components, such ...[truncated 2013 chars]- Remediation
View remediation