T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:269- Finding
Workspace Escape Enables Arbitrary Local File Reads and Identifier-Derived Network Disclosure
- Content
View full analysis
dict[str, Any]: url = f"https://export.arxiv.org/api/query?id_list={arxiv_id}" req = urllib.request.Request(url, headers={"User-Agent": "codex-agent-survey-corpus/1.0"}) with urllib.request.urlopen(req, timeout=30) as resp: data = resp.read() ``` ```python for arxiv_id in arxiv_ids: rec: dict[str, Any] = { "arxiv_id": arxiv_id, "pdf_url": f"https://arxiv.org/pdf/{arxiv_id}.pdf", "pdf_path": str((pdf_dir / f"{arxiv_id}.pdf").relative_to(workspace)), "text_path": str((text_dir / f"{arxiv_id}.txt").relative_to(workspace)), "max_pages": int(args.max_pages), "status": "", "error": "", "pages_extracted": 0, } try: rec.update(_fetch_arxiv_meta(arxiv_id)) ``` ### Technical Analysis `--inputs` is treated as a workspace-relative path without enforcing that constraint. In `pathlib`, when the right-hand operand of `/` is absolute, the left-hand workspace path is discarded. Relative traversal components such as `../` are also not rejected. Consequently, a caller that controls `--inputs`, or a pipeline unit whose `inputs` field is attacker-controlled, can direct `_read_ids()` to any readable text file accessible to the process. `_read_ids()` interprets each nonempty, non-comment line as an arXiv identifier. Those lines are then in ...[truncated 1991 chars]- Remediation
View remediation