T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search_everything.py:99- Finding
Unverified user-configurable DLL loading permits native code execution
- Content
View full analysis
Path: if explicit: path = Path(explicit).expanduser().resolve() if not path.is_file(): raise FileNotFoundError(f"找不到指定的 Everything SDK DLL: {path}") return path configured = os.environ.get("EVERYTHING_SDK_DLL") if configured: path = Path(configured).expanduser().resolve() if not path.is_file(): raise FileNotFoundError(f"EVERYTHING_SDK_DLL 指向的文件不存在: {path}") return path try: return materialize_bundled_dll() except FileNotFoundError: pass checked = [] for path in candidate_dlls(): resolved = path.resolve() checked.append(str(resolved)) if resolved.is_file(): return resolved details = "\n".join(f"- {path}" for path in checked) raise FileNotFoundError( f"找不到与当前 Python 架构匹配的 {sdk_dll_name()}。已检查:\n{details}\n" "请通过 --dll 指定可信 DLL，或设置 EVERYTHING_SDK_DLL。" ) class EverythingClient: def __init__(self, dll_path: Path): try: self.dll = ctypes.WinDLL(str(dll_path)) except OSError as exc: raise RuntimeError( f"无法加载 DLL: {dll_path}。请确认 DLL 与 {python_bits()} 位 Python 匹配。原始错误: {exc}" ) from exc self.dll_path = dll_path self._bind() ``` ### Technical Analysis The bundled Everything SDK DLLs are protected by fixed SHA-256 checks in `materialize_bundled_dll()`. However, DLL paths supplied through the `--dll` argument or the `EVERYTHING_SDK_DLL` environment variable are accepted after only confirming that the path points to a file. No SHA-256 allowlist, Authenticode signature verification, trusted-directory restriction, or ownership and access-control check is ap ...[truncated 1728 chars]- Remediation
View remediation