T09 · Insecure Skill Coding Practices
Error
- Location
scripts/organize.py:287- Finding
Unvalidated Configuration Paths Can Move Files Outside the Selected Directory
- Content
View full analysis
Path: """创建归档目录结构""" date_format = self.config["归档设置"].get("日期格式", "YYYY/MM/DD") # 转换日期格式 archive_path = date_format archive_path = archive_path.replace("YYYY", str(file_date.year)) archive_path = archive_path.replace("MM", f"{file_date.month:02d}") archive_path = archive_path.replace("DD", f"{file_date.day:02d}") full_path = base_path / "Archive" / archive_path return full_path ``` ```python # 分类模式 if mode["分类"]: target_dir = base_path / category # 生成新文件名 new_filename = filepath.name if mode["重命名"] and self.config["重命名规则"]["启用"]: with self.lock: new_filename = self.generate_new_filename( filepath, category, self.stats["organized_files"] + 1 ) self.stats["renamed_files"] += 1 target_path = target_dir / new_filename # 处理文件名冲突 if target_path.exists() and target_path != filepath: counter = 1 stem = target_path.stem while target_path.exists(): target_path = target_dir / f"{stem}_copy{counter}{filepath.suffix}" counter += 1 if preview: with self.lock: self.log_operation(f"[预览] {icon} {filepath.name} → {category}/{new_filename}") else: # 创建目标目录 target_dir.mkdir(exist_ok=True) # 备份 if self.config["安全设置"]["自动备份"]: backup_dir = base_path / "Backup" backup_dir.mkdir(exist_ok=True) self.backup_file(filepath, backup_dir) # 移动文件 shutil.move(str(filepath), str(target_path)) ``` ### Technical Analysis Category directory names, archive formats, and filename templates can be supplied through a user ...[truncated 1850 chars]- Remediation
View remediation