T09 · Insecure Skill Coding Practices
- Location
scripts/create_structure.py:61- Finding
Unsafe Overwrite and Symlink Following During Project Structure Creation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/create_structure.py, lines 61-65
Vulnerability Type: Unsafe file overwrite and symlink traversal
Risk Level: MediumVulnerable Code
python for file_path, content in example_files.items(): full_path = project_path / file_path full_path.parent.mkdir(parents=True, exist_ok=True) with open(full_path, 'w') as f: f.write(content)The relevant generic confirmation logic is at lines 84-89:
python if project_path.exists(): print(f"警告: 路径已存在: {project_path}") response = input("是否继续? (y/N): ") if response.lower() != 'y': print("已取消") sys.exit(0)Technical Analysis
The script opens every placeholder file with mode
w, which truncates an existing file before writing the new content. It does not check whether individual files already exist or disclose which files will be replaced. For example, an existingconfig/settings.jsonis unconditionally replaced with{}after the user accepts only a generic project-level confirmation.The script also does not reject symbolic links or verify resolved-path containment. If a target file such as
config/settings.json, or one of its parent directories, is a symbolic link, Python follows that link when opening the destination. A crafted project directory can therefore redirect a write outside the selected project root.This is a fixed-content arbitrary file-write primitive rather than arbitrary-content code execution: the attacker can choose a writable target through a symlink, while the content written is determined by the script's
example_filesmapping.Attack Path
- An attacker prepares a directory that appears to be an existing project.
- The attacker creates a symbolic link at a generated path, such as
config/settings.json, pointing to a file writable by the victim. Alternatively, the directory already contains legitimate files at the placeholder paths. - The victim or an Agent ...[truncated 1305 chars]
- Remediation
View remediation
Remediation Suggestions
-
Do not overwrite existing files by default. Use exclusive creation mode and handle
FileExistsError:python with open(full_path, "x", encoding="utf-8") as f: f.write(content)Alternatively, explicitly skip every destination that already exists.
-
Require granular overwrite consent. If replacement is supported, enumerate the exact files that would be changed and require explicit confirmation before modifying them.
-
Reject symbolic links. Check every existing destination and parent path component with
is_symlink()oros.lstat()and abort if a symbolic link is encountered. -
Enforce path containment. Resolve the project root and each destination, then verify that every destination remains beneath the resolved root before writing:
python root = project_path.resolve() destination = full_path.resolve(strict=False) destination.relative_to(root)Abort when
relative_toraisesValueError. -
Reduce race-condition exposure. Path checks alone can be bypassed if an attacker can modify directories concurrently. On supported platforms, use directory-relative file operations with no-follow semantics, such as
openat-style operations andO_NOFOLLOW. -
Use atomic replacement only when intentional. Write to a safely and exclusively created temporary file within the verified destination directory, set appropriate permissions, and atomically rename it after explicit authorization.
-
Add regression tests covering existing files, symlinked target files, symlinked parent directories, paths outside the project root, and cancellation without filesystem changes.
-