T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imap.js:16- Finding
Attachment Download Can Overwrite Files and Follow Symbolic Links
- Content
View full analysis
path.resolve(d.trim().replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => resolved === dir || resolved.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${dirPath}' is outside allowed write directories`); } return resolved; } ``` ```javascript for (const attachment of parsed.attachments) { // If specificFilename is provided, only download matching attachment if (specificFilename && attachment.filename !== specificFilename) { continue; } if (attachment.content) { const filePath = path.join(resolvedDir, sanitizeFilename(attachment.filename)); fs.writeFileSync(filePath, attachment.content); downloaded.push({ filename: attachment.filename, path: filePath, size: attachment.size, }); } } ``` ### Technical Analysis The output-directory validation uses `path.resolve()`, which only performs lexical path normalization. It does not resolve symbolic links or verify that the actual filesystem destination remains beneath an authorized directory. Although `sanitizeFilename()` removes directory traversal components by retaining the basename, the final destination is passed directly to `fs.writeFileSync()`. This operation: - Follows an existing symbolic link at the destination. - Silently truncates and overwrites an existing file. - Does not use exclusive creation. - Does ...[truncated 2762 chars]- Remediation
View remediation