T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gzh.py:113- Finding
Path Traversal Through Unvalidated Account and Author Names
- Content
View full analysis
- Remediation
View remediation
str: if not value or not SAFE_NAME.fullmatch(value): raise ValueError(f"Invalid {field}") if value in {".", ".."}: raise ValueError(f"Invalid {field}") return value ``` 2. Reject `/`, `\`, drive prefixes, absolute paths, null bytes, and parent-directory components explicitly. 3. Resolve every destination and verify that it is a descendant of the intended base directory: ```python def safe_output_path(base: Path, filename: str) -> Path: base = base.resolve() candidate = (base / filename).resolve() if candidate.parent != base: raise ValueError("Output path escapes the designated directory") return candidate ``` 4. Use a stable internal identifier, such as a digest of the account ID, for cache filenames rather than a raw external value. 5. Store display names inside file content rather than using them directly as filenames. 6. Add tests covering `../`, absolute paths, Windows drive paths, UNC paths, Unicode separators, empty names, and oversized values. 7. Use restrictive permissions when creating files that may contain complete article data. ]]>