T09 · Insecure Skill Coding Practices
Warning
- Location
deep-search-report.py:185- Finding
Unsafe User-Specified Stream File Handling Enables Local Disclosure and Symlink-Based File Modification
- Content
View full analysis
Optional[str]: """Return stream file path, preferring user-specified path.""" if specified_path: abs_path = os.path.abspath(specified_path) parent_dir = os.path.dirname(abs_path) or "." if not os.path.isdir(parent_dir): raise UniFuncsDeepSearchError(f"Stream file directory does not exist: {parent_dir}") if not os.access(parent_dir, os.W_OK): raise UniFuncsDeepSearchError(f"Stream file directory is not writable: {parent_dir}") if not os.path.exists(abs_path): with open(abs_path, "w", encoding="utf-8"): pass return abs_path return create_temp_stream_file() ``` The returned path is subsequently reopened in append mode and populated with API response data: ```python temp_path = resolve_stream_file_path(stream_file_path) content_parts: list[str] = [] done = False started_at = time.monotonic() try: with urllib.request.urlopen(req, timeout=DEFAULT_REQUEST_TIMEOUT_SECONDS) as response: writer = open(temp_path, "a", encoding="utf-8") if temp_path else None try: while True: if time.monotonic() - started_at >= stream_timeout_seconds: break line = response.readline() if not line: done = True break decoded = line.decode("utf-8", errors="replace") if writer: writer.write(decoded) ``` ### Technical Analysis When `--stream-file` is supplied, the implementation validates the path and ...[truncated 2253 chars]- Remediation
View remediation