T09 · Insecure Skill Coding Practices
Error
- Location
server.py:29- Finding
Unauthenticated Cross-Origin Arbitrary File Write
- Content
View full analysis
bool: """只允许写到用户家目录或 /tmp 下，避免任意路径写入。""" try: p = p.resolve() except Exception: return False home = Path.home().resolve() tmp = Path("/tmp").resolve() return any(str(p).startswith(str(root) + os.sep) for root in (home, tmp)) class Handler(http.server.BaseHTTPRequestHandler): def _cors(self): self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Access-Control-Allow-Methods", "POST, GET, OPTIONS") self.send_header("Access-Control-Allow-Headers", "Content-Type") def do_POST(self): if self.path != "/feedback": return self._json(404, {"ok": False, "error": "not found"}) try: length = int(self.headers.get("Content-Length", 0)) raw = self.rfile.read(length).decode("utf-8") body = json.loads(raw) except Exception as e: return self._json(400, {"ok": False, "error": f"invalid json: {e}"}) inbox = body.get("inbox") payload = body.get("payload") if not inbox or not isinstance(payload, dict): return self._json( 400, {"ok": False, "error": "missing inbox or payload"} ) inbox_path = Path(inbox) if not is_path_allowed(inbox_path): return self._json( 403, {"ok": False, "error": f"path not allowed: {inbox_path}"} ) try: inbox_path.parent.mkdir(parents=True, exist_ok=True) inbox_path.write_text( json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8", ) except Exception as e: return self._json(500, {"ok": False, "error ...[truncated 2025 chars]- Remediation
View remediation