T09 · Insecure Skill Coding Practices
Warning
- Location
src/image_generator.py:221- Finding
Unvalidated Remote Image Download with Unsafe Temporary-File Creation
- Content
View full analysis
Optional[str]: """下载图片到本地""" try: response = requests.get(url, timeout=60) if response.status_code == 200: filename = f"moyu_{abs(hash(prompt)) % 100000}.png" filepath = f"/tmp/{filename}" with open(filepath, 'wb') as f: f.write(response.content) return filepath except Exception as e: print(f"下载失败: {e}") return None ``` ### Technical Analysis The image URL returned by MiniMax or DashScope is passed directly to `requests.get()` without validating: - The URL scheme - The destination hostname - Redirect destinations - The response `Content-Type` - The downloaded file signature - The maximum response size The use of `response.content` buffers the entire response in memory before writing it to disk. A provider-side compromise, malicious API response, or compromised image CDN could therefore direct the Skill to an unintended destination or return an excessively large response. The resulting file is written to a predictable shared `/tmp` namespace using ordinary `open(..., "wb")`. This operation is not an exclusive file creation and follows symbolic links. If a local attacker can predict or discover the generated path and create a symbolic link there before the write, the process may overwrite another file writable by the Skill's user. The downloaded file is later opened by Pillow during watermark processing, increasing exposure to malformed-image parser vulnerabilities. ### Attack Path 1. The user invokes image generation with MiniMax or DashScope. 2. The external provider returns an image URL controlled by a compromised provider account, ...[truncated 1561 chars]- Remediation
View remediation