T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/_baidu_image_classify.py:46- Finding
Arbitrary Readable Local Files Can Be Uploaded to Baidu APIs
- Content
View full analysis
str: p = Path(image_path) if not p.exists() or not p.is_file(): raise FileNotFoundError(f"image_path not found: {image_path}") return base64.b64encode(p.read_bytes()).decode("utf-8") def build_image_payload(payload: Dict[str, Any]) -> Dict[str, Any]: data: Dict[str, Any] = {} image_base64 = payload.get("image_base64") image_path = payload.get("image_path") image_url = payload.get("url") if image_base64: if image_base64.startswith("data:") and "," in image_base64: image_base64 = image_base64.split(",", 1)[1] data["image"] = image_base64 elif image_path: data["image"] = read_image_base64(image_path) elif image_url: data["url"] = image_url else: raise ValueError("One of image_base64/image_path/url must be provided") return data ``` This shared function is used by every OCR and image-classification entry point. ### Technical Analysis The Skill declares that `image_path` identifies a local image, but the implementation only checks that the supplied path exists and is a regular file. It does not verify: - That the file contains a supported image format. - That its detected MIME type matches an allowed image type. - That the path is inside an approved workspace or upload directory. - That the path does not resolve through a symbolic link. - That the file is within a safe size limit. - That the user has explicitly approved transmitting the selected local file. `Path.read_bytes()` therefore reads any regular file accessible to the Skill process. Base64 encoding provides no confidentiality; it only serializes the file for submission. The resulting value is placed in the `image` request param ...[truncated 1813 chars]- Remediation
View remediation