T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/upload.py:73- Finding
Overly Broad Temporary-Directory Access Allows Unintended File Uploads
- Content
View full analysis
list[str]: global _ALLOWED_PREFIXES if _ALLOWED_PREFIXES is not None: return _ALLOWED_PREFIXES prefixes: list[str] = [] # 1) WORKSPACE (or cwd) — the project the agent is operating in ws = os.environ.get("WORKSPACE", os.getcwd()) prefixes.append(os.path.realpath(ws)) # 2) sibling userdata/ directory (Cursor sandbox convention) ud = os.path.join(os.path.dirname(ws), "userdata") if ws else "" if ud: prefixes.append(os.path.realpath(ud)) # 3) /tmp — commonly used for scratch files prefixes.append("/tmp") # 4) VOD_UPLOAD_ALLOWED_DIRS — comma-separated extra directories extra = os.environ.get("VOD_UPLOAD_ALLOWED_DIRS", "") for d in extra.split(","): d = d.strip() if d: prefixes.append(os.path.realpath(d)) _ALLOWED_PREFIXES = prefixes return _ALLOWED_PREFIXES def _validate_local_path(file_path: str) -> None: """Ensure the resolved path falls under an allowed prefix (symlink-safe).""" real = os.path.realpath(file_path) for prefix in _get_allowed_prefixes(): if real == prefix or real.startswith(prefix + os.sep): return ``` ### Technical Analysis The path validation explicitly permits every path beneath the system-wide `/tmp` directory. Although `os.path.realpath` prevents a straightforward symlink escape from an allowed directory, it does not mitigate the excessive scope of the allowed directory itself. The subsequent validation only requires a filename extension and does not verify that the selected file is media through an extension allowlist, MIME inspection, or content signature. Consequently, readable logs, archives, text files, credentials, session artifacts, or tempo ...[truncated 1580 chars]- Remediation
View remediation