T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils.py:130- Finding
Path Traversal in CSV Export Filename
- Content
View full analysis
str: """Export data to CSV.""" import csv import os filepath = os.path.join('data', 'exports', filename) os.makedirs(os.path.dirname(filepath), exist_ok=True) if not data: return "" with open(filepath, 'w', newline='', encoding='utf-8') as f: writer = csv.DictWriter(f, fieldnames=data[0].keys()) writer.writeheader() writer.writerows(data) ``` ### Technical Analysis The function incorporates the caller-controlled `filename` directly into a filesystem path without rejecting absolute paths, parent-directory components, symbolic-link traversal, or other path separators. `os.path.join()` does not enforce containment. A value such as `../../target.csv` can escape `data/exports`, while an absolute filename can cause the preceding path components to be discarded. The destination is then opened in write mode, which creates the file or truncates an existing file. This function is not currently called by `src/app.py`, so the reviewed application does not expose a direct remote exploit path. It nevertheless creates an unsafe reusable capability that becomes exploitable if connected to user input, an API, a plugin, or another automation workflow. ### Attack Path 1. An attacker gains control over the `filename` argument through a future interface or an internal caller. 2. The attacker supplies a traversal path such as `../../outside.csv` or an absolute path. 3. `os.path.join('data', 'exports', filename)` produces a path outside the intended export directory. 4. `os.makedirs()` may create attacker-selected directories. 5. `open(..., 'w')` creates or truncates the selected file. 6. CSV data controlled through the `data` argument is written unde ...[truncated 574 chars]- Remediation
View remediation