T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/minivcs/minivcs.py:493- Finding
Unrestricted File Operations Outside the Project Root
- Content
View full analysis
str: if absolute_path.startswith(self.project_root + os.sep): return absolute_path[len(self.project_root) + 1 :] return absolute_path ``` The modification and deletion operations accept the resulting unrestricted path: ```python def record_modify(self, file_path: str) -> Dict[str, Any]: abs_path = os.path.abspath(file_path) if not os.path.exists(abs_path): return {"success": False, "error": f"File not found: {file_path}"} ``` ```python def record_delete(self, file_path: str) -> Dict[str, Any]: abs_path = os.path.abspath(file_path) if not os.path.exists(abs_path): return {"success": False, "error": f"File not found: {file_path}"} ``` Restore operations preserve absolute paths and can write directly to them: ```python file_path = record.get("filePath", "") target_path = file_path if os.path.isabs(file_path) else os.path.join(self.project_root, file_path) success = self.file_manager.restore_from_trash(trash_file, target_path) ``` ```python file_path = record.get("filePath", "") target_path = file_path if os.path.isabs(file_path) else os.path.join(self.project_root, file_path) os.makedirs(os.path.dirname(target_path), exist_ok=True) with open(target_path, "w", encoding="utf-8") as f: f.write(content) ``` ### Technical Analysis `project_root` is used only to convert paths into relative record names. It is not enforced as an authorization boundary. If a target is outside the project, `_get_relative_path()` deliberately returns its absolute path. As a result, th ...[truncated 2432 chars]- Remediation
View remediation