T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/emit_media_reply.py:38- Finding
Unrestricted Local File Paths Can Be Transmitted to WeChat
- Content
View full analysis
int: ap = argparse.ArgumentParser() ap.add_argument("file_path") ap.add_argument("--recipient", default="当前会话") ap.add_argument("--text", default="") ap.add_argument("--json-envelope", action="store_true", help="also emit legacy json envelope fields for debugging only") args = ap.parse_args() path = Path(args.file_path).expanduser().resolve() exists = path.exists() result = { "ok": exists, "file_path": str(path), "exists": exists, "recipient": args.recipient, } if not exists: result.update({ "error": "file_not_found", "message": f"file not found: {path}", }) print(json.dumps(result, ensure_ascii=False, indent=2)) return 1 media_type = guess_media_type(path) reply_text = render_reply_text(path, args.recipient, media_type, args.text) result.update({ "mediaType": media_type, "fileName": path.name, "mediaUrl": to_file_url(path), "reply_text": reply_text, "size": path.stat().st_size, }) ``` The documented workflow explicitly accepts arbitrary absolute paths and treats all non-image types as sendable files: ```markdown - Send a non-image file such as a PDF, text file, archive, or document. ... - `file_path`: absolute local path to an existing file, or a screenshot path produced earlier. ... 2. Ensure the target file exists. 3. Run `scripts/emit_media_reply.py` to validate the file and build the plain-text reply payload. 4. Return the script's `reply_text` value as the assistant message. ... Treat everything else as files. ``` ### Technical Analysis The helper resolves ...[truncated 2794 chars]- Remediation
View remediation