T09 · Insecure Skill Coding Practices
- Location
excel_parser.py:237- Finding
Path Traversal and Arbitrary XLSX File Write in Column-Based Split Operation
- Content
View full analysis
Vulnerability Details
File Location:
excel_parser.py:237-252
Vulnerability Type: Untrusted spreadsheet data used in an output file path
Risk Level: Highpython @staticmethod def split_by_column(input_path: str, output_dir: str, column: str): """按列拆分Excel""" if not PANDAS_AVAILABLE: raise ImportError('pandas not installed') df = pd.read_excel(input_path) os.makedirs(output_dir, exist_ok=True) for value, group in df.groupby(column): filename = os.path.join(output_dir, f'{value}.xlsx') group.to_excel(filename, index=False) return output_dirTechnical Analysis
The values in the attacker-influenced grouping column are inserted directly into output filenames. The implementation does not reject absolute paths, parent-directory components such as
.., or path separators.As a result, a grouping value such as
../targetproduces a path similar tooutput_dir/../target.xlsx. If an absolute grouping value is accepted,os.path.join()can also discard the intended output directory. The subsequentgroup.to_excel()call creates or overwrites the resolved file without checking whether it remains insideoutput_dir.Exploitation requires the attacker to control a workbook processed by
split_by_column()and the process to have write permission at the resolved destination.Attack Path
- An attacker creates an XLSX workbook containing the expected grouping column.
- A row in that column is assigned a traversal-oriented value such as
../target. - A user or automated workflow invokes
ExcelParser.split_by_column()on the workbook. - The grouping value is interpolated into
f'{value}.xlsx'. os.path.join()resolves the constructed path outside the intended output directory.group.to_excel()creates or overwrites the resulting XLSX file using the privileges of the running process.
Impac
...[truncated 458 chars]
- Remediation
View remediation
Remediation Suggestions
- Never use spreadsheet values directly as filenames.
- Convert values to a controlled filename representation and reject absolute paths,
..,/,\, drive prefixes, control characters, and platform-specific reserved names. - Resolve both the output directory and candidate path to canonical absolute paths, then verify that the candidate is a descendant of the output directory.
- Generate opaque filenames, such as UUIDs or numeric sequence identifiers, and maintain a separate mapping to the original grouping values.
- Apply an explicit overwrite policy. Refuse to replace existing files unless replacement was deliberately requested.
- Add tests covering parent traversal, absolute paths, Windows drive and UNC paths, embedded separators, reserved filenames, and filename collisions.