T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/_baidu_image_classify.py:46
- Finding
- Arbitrary Readable Local Files Can Be Uploaded to Baidu APIs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_baidu_image_classify.py:46-67` **Vulnerability Type**: Missing file-type, path-scope, and upload validation **Risk Level**: Medium ### Vulnerable Code ```python def read_image_base64(image_path: str) -> str: p = Path(image_path) if not p.exists() or not p.is_file(): raise FileNotFoundError(f"image_path not found: {image_path}") return base64.b64encode(p.read_bytes()).decode("utf-8") def build_image_payload(payload: Dict[str, Any]) -> Dict[str, Any]: data: Dict[str, Any] = {} image_base64 = payload.get("image_base64") image_path = payload.get("image_path") image_url = payload.get("url") if image_base64: if image_base64.startswith("data:") and "," in image_base64: image_base64 = image_base64.split(",", 1)[1] data["image"] = image_base64 elif image_path: data["image"] = read_image_base64(image_path) elif image_url: data["url"] = image_url else: raise ValueError("One of image_base64/image_path/url must be provided") return data ``` This shared function is used by every OCR and image-classification entry point. ### Technical Analysis The Skill declares that `image_path` identifies a local image, but the implementation only checks that the supplied path exists and is a regular file. It does not verify: - That the file contains a supported image format. - That its detected MIME type matches an allowed image type. - That the path is inside an approved workspace or upload directory. - That the path does not resolve through a symbolic link. - That the file is within a safe size limit. - That the user has explicitly approved transmitting the selected local file. `Path.read_bytes()` therefore reads any regular file accessible to the Skill process. Base64 encoding provides no confidentiality; it only serializes the file for submission. The resulting value is placed in the `image` request param ...[truncated 1813 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict local inputs to explicitly approved workspace or upload directories: - Resolve the path with `Path.resolve(strict=True)`. - Confirm that the resolved path is beneath an allowlisted root. - Reject paths outside that root. 2. Reject symbolic links and non-regular filesystem objects before reading them. 3. Validate actual file contents rather than trusting the extension: - Decode the file with a maintained image library. - Permit only required formats, such as JPEG, PNG, WebP, or BMP. - Reject malformed, unsupported, or decompression-bomb images. - Re-encode the decoded image before uploading to ensure unrelated appended data is not transmitted. 4. Enforce conservative compressed-byte and decoded-dimension limits before loading the complete file into memory. 5. Require explicit user confirmation that identifies the resolved local path and the third-party destination before uploading sensitive local content. 6. Document clearly that local image bytes are sent to Baidu and may be processed according to Baidu's data-handling policies. 7. Where possible, replace unrestricted path input with an opaque attachment identifier supplied by a trusted host application. ]]>