T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auto_send.py:104- Finding
Symbolic Link Traversal May Expose Files Outside the Watched Directory
- Content
View full analysis
MAX_FILE_SIZE_MB: return False, f"File too large ({size_mb:.1f}MB > {MAX_FILE_SIZE_MB}MB)" ``` ```python for item in Path(directory).glob(pattern): if item.is_file(): files.append(str(item.absolute())) ``` ```python def generate_send_command(filepath, recipient=None, message=None): """Generate the message.send tool call""" filename = os.path.basename(filepath) cmd = { "action": "send", "filePath": filepath, "filename": filename } if recipient: cmd["target"] = recipient ``` ### Technical Analysis The directory scanner accepts entries for which `Path.is_file()` returns true. Both `Path.is_file()` and `os.path.isfile()` follow symbolic links by default. The subsequent size and modification-time checks also operate on the linked target. Although `item.absolute()` creates an absolute path, it does not securely resolve the path and verify that the final target remains under the configured watch directory. The code also does not reject symbolic links. Consequently, a symbolic link located inside the watched directory can point to a readable file elsewhere on the local filesystem and still pass validation when: - The target is a regular file. - Its apparent extension is included in `SUPPORTED_EXTENSIONS`. - Its size does not exceed 30 MB. - It satisfies the file-age and stability checks. The resulting path is embedded in a `message.send` instruction. The script itself only prints this instruction and does not perform a network request. Exploitation therefore requires the surrou ...[truncated 1795 chars]- Remediation
View remediation