T09 · Insecure Skill Coding Practices
- Location
scripts/client.py:142- Finding
Unrestricted Local File Upload Through the Image Editing Interface
- Content
View full analysis
Vulnerability Details
File Location:
scripts/client.py, lines 142-147
Vulnerability Type: Unrestricted local-file read and external upload
Risk Level: MediumVulnerable Code
python for img in images: # Supports local files if os.path.exists(img): with open(img, "rb") as f: b64 = base64.b64encode(f.read()).decode() content.append({"image": f"data:image/jpeg;base64,{b64}"}) else: content.append({"image": img})Technical Analysis
The image editing interface treats every existing filesystem path as a valid image. It reads the entire file, Base64-encodes it, labels it as JPEG data, and subsequently sends it to the configured DashScope API endpoint.
Base64 encoding is a legitimate transport mechanism for local image uploads and is not, by itself, evidence of covert exfiltration. The security issue is the absence of controls confirming that the selected file is an image appropriate for upload. The implementation does not validate:
- The file extension or detected MIME type.
- The file's image signature or whether an image parser can decode it.
- The resolved path or whether it is located in an approved directory.
- Whether the path points to a regular file rather than a special filesystem object.
- The documented 10 MB input limit.
- Whether the selected path is likely to contain credentials or system configuration.
Consequently, any readable local file can be submitted through the editing interface. This behavior exceeds the minimum file access needed for image editing, which only requires access to user-selected and validated image files.
Attack Path
- An attacker or untrusted instruction influences the
editcommand's image argument. - The supplied argument identifies a readable sensitive file rather than an image.
os.path.exists(img)returns true.- The client reads the entire file without validating its typ ...[truncated 1088 chars]
- Remediation
View remediation
Remediation Suggestions
- Resolve the candidate path with
Path.resolve()and permit local uploads only from explicitly approved directories. - Require explicit user confirmation before uploading any local file to an external service.
- Reject symbolic links, device files, named pipes, and other non-regular files.
- Enforce an allowlist of supported image extensions.
- Verify the actual file signature and decode the file with a trusted image library before upload; do not rely only on extensions.
- Enforce the documented maximum input size before reading or encoding the file.
- Derive the correct MIME type instead of unconditionally labeling every file as
image/jpeg. - Consider accepting file objects selected through a trusted image picker rather than arbitrary filesystem paths.
- Clearly disclose that selected local images are transmitted to DashScope for processing.
- Resolve the candidate path with