T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wiseocr.py:169- Finding
Unrestricted Output Name Allows Directory Traversal and File Overwrite
- Content
View full analysis
None: """Save OcrResult to a markdown file.""" markdown = data.get("markdown", "") total_pages = data.get("total_pages", 1) elapsed = data.get("elapsed_seconds", 0) usage = data.get("usage") or {} print(f"[*] Total pages: {total_pages}") print(f"[*] Processing time: {elapsed:.1f}s") if usage: print(f"[*] Usage: prompt_tokens={usage.get('prompt_tokens')}, " f"completion_tokens={usage.get('completion_tokens')}, " f"ocr_pic_size={usage.get('ocr_pic_size')}, " f"total_tokens={usage.get('total_tokens')}") out_path = output_dir / f"{stem}.md" out_path.write_text(markdown, encoding="utf-8") print(f"[+] Markdown saved: {out_path}") ``` The value passed as `stem` originates from the command-line `--name` argument without validation: ```python stem = name if name else p.stem _save_result(resp.json(), out_dir, stem) ``` ```python parser.add_argument( "-n", "--name", help="Output filename stem (recommended when input file is renamed/copied)" ) ``` ### Technical Analysis The `--name` argument is described as a filename stem, but the implementation accepts path separators, `..` traversal components, and absolute paths. When a relative value such as `../../notes` is supplied, joining it with `output_dir` does not constrain the resulting path to that directory. If an absolute path is supplied, `pathlib` discards the preceding output directory entirely. The subsequent `Path.write_text()` call creates or truncates the resolved destination. The implementation also does not reject ...[truncated 1762 chars]- Remediation
View remediation