T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/design_system.py:511- Finding
Path Traversal in Persisted Design-System Output Names
- Content
View full analysis
/` hierarchy. The use of `open(..., 'w')` also truncates an existing target file without confirmation. The project-name path always ends in ` ...[truncated 2257 chars]- Remediation
View remediation
str: slug = value.strip().lower().replace(" ", "-") if not re.fullmatch(r"[a-z0-9_-]+", slug): raise ValueError("Name contains unsupported characters") if slug in {".", ".."}: raise ValueError("Invalid path name") return slug root = (base_dir / "design-system").resolve() project_slug = safe_slug(project_name) design_system_dir = (root / project_slug).resolve() if not design_system_dir.is_relative_to(root): raise ValueError("Output path escapes the design-system directory") ``` 3. Apply the same validation independently to `page` before constructing the page filename. 4. Verify the final file path remains below the expected project or pages directory after resolution: ```python pages_root = (design_system_dir / "pages").resolve() page_file = (pages_root / f"{safe_slug(page)}.md").resolve() if not page_file.is_relative_to(pages_root): raise ValueError("Page path escapes the pages directory") ``` 5. Avoid silent replacement of existing files. Use exclusive creation mode (`'x'`) by default, create a backup, or require an explicit `--force` option before overwriting. 6. Add automated tests covering `../`, nested traversal, absolute paths, platform-specific separators, empty names, Unicode separator lookalikes, and valid names. ]]>