T09 · Insecure Skill Coding Practices
Error
- Location
lib/tqcenter.py:725- Finding
Path Traversal Enables Arbitrary File Deletion and Overwrite
- Content
View full analysis
- Remediation
View remediation
Path: if Path(supplied_name).name != supplied_name: raise ValueError("Only simple filenames are permitted") if not supplied_name.lower().endswith(extension): raise ValueError(f"Filename must end with {extension}") root = root.resolve() destination = (root / supplied_name).resolve() destination.relative_to(root) return destination ``` 4. Write directly to a validated destination rather than first creating a file in the current working directory. 5. Use a securely created temporary file in the validated target directory and perform an atomic `os.replace()` only after serialization succeeds. 6. Do not automatically delete an existing file unless replacement is explicitly requested and authorized. 7. Run the exporter under a low-privilege account that has write access only to the required TongdaXin data directories. 8. Add automated tests covering absolute paths, Windows drive paths, UNC paths, mixed separators, encoded traversal, and repeated `..` components. ]]>