T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/imap.js:16- Finding
Attachment download allowlist can be bypassed through symbolic links
- Content
View full analysis
path.resolve(d.replace(/^~/, os.homedir())) ); const allowed = allowedDirs.some(dir => resolved === dir || resolved.startsWith(dir + path.sep) ); if (!allowed) { throw new Error(`Access denied: '${dirPath}' is outside allowed write directories`); } return resolved; } ``` The validated path is subsequently used without checking for symbolic links: ```javascript const filePath = path.join(resolvedDir, sanitizeFilename(attachment.filename)); fs.writeFileSync(filePath, attachment.content); ``` ### Technical Analysis The destination allowlist is enforced through lexical normalization with `path.resolve()`. This removes path traversal components such as `..`, but it does not resolve symbolic links or establish where the filesystem will ultimately write the data. Consequently, a directory located lexically beneath an allowed directory can be a symbolic link to a location outside that directory. The final attachment path may also already be a symbolic link. Because `fs.writeFileSync()` follows symbolic links by default, either condition can redirect the write outside `ALLOWED_WRITE_DIRS`. The filename sanitization prevents direct `../` traversal but does not mitigate symlink-based redirection or a time-of-check/time-of-use replacement between validation and writing. ### Attack Path 1. The configuration permits attachment writes to a directory such as `~/Downloads`. 2. A local attacker o ...[truncated 1319 chars]- Remediation
View remediation