T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search_everything.py:99
- Finding
- Unverified user-configurable DLL loading permits native code execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_everything.py:99-137` **Vulnerability Type**: Unverified native library loading **Risk Level**: Medium ### Complete Code Snippet ```python def resolve_dll(explicit: str | None) -> Path: if explicit: path = Path(explicit).expanduser().resolve() if not path.is_file(): raise FileNotFoundError(f"找不到指定的 Everything SDK DLL: {path}") return path configured = os.environ.get("EVERYTHING_SDK_DLL") if configured: path = Path(configured).expanduser().resolve() if not path.is_file(): raise FileNotFoundError(f"EVERYTHING_SDK_DLL 指向的文件不存在: {path}") return path try: return materialize_bundled_dll() except FileNotFoundError: pass checked = [] for path in candidate_dlls(): resolved = path.resolve() checked.append(str(resolved)) if resolved.is_file(): return resolved details = "\n".join(f"- {path}" for path in checked) raise FileNotFoundError( f"找不到与当前 Python 架构匹配的 {sdk_dll_name()}。已检查:\n{details}\n" "请通过 --dll 指定可信 DLL，或设置 EVERYTHING_SDK_DLL。" ) class EverythingClient: def __init__(self, dll_path: Path): try: self.dll = ctypes.WinDLL(str(dll_path)) except OSError as exc: raise RuntimeError( f"无法加载 DLL: {dll_path}。请确认 DLL 与 {python_bits()} 位 Python 匹配。原始错误: {exc}" ) from exc self.dll_path = dll_path self._bind() ``` ### Technical Analysis The bundled Everything SDK DLLs are protected by fixed SHA-256 checks in `materialize_bundled_dll()`. However, DLL paths supplied through the `--dll` argument or the `EVERYTHING_SDK_DLL` environment variable are accepted after only confirming that the path points to a file. No SHA-256 allowlist, Authenticode signature verification, trusted-directory restriction, or ownership and access-control check is ap ...[truncated 1728 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable arbitrary DLL overrides by default and use only the hash-pinned bundled payload. 2. If overrides are necessary, require an explicit expected SHA-256 value and compare it before loading. 3. Verify the DLL's Authenticode signature and require the expected publisher, `voidtools PTY LTD`. 4. Restrict accepted DLLs to an administrator-controlled directory that is not writable by untrusted users. 5. Reject network paths, relative paths, reparse points, and files whose final resolved location falls outside the trusted directory. 6. Validate file ownership and discretionary access controls before loading. 7. Avoid searching the current working directory for DLLs because it may be attacker-controlled. 8. Document that `EVERYTHING_SDK_DLL` is security-sensitive and remove it from inherited environments in service and automation deployments. ]]>