T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/itinerary_generator.py:384- Finding
Path Traversal Through Itinerary Output Filename
- Content
View full analysis
3 else "romantic" generator = TravelItineraryGenerator(destination, duration, trip_type) itinerary = generator.generate_full_itinerary() # Save to file output_file = f"{destination.lower()}_itinerary_{duration}days.json" save_itinerary_to_file(itinerary, output_file) ``` The resulting path is passed to the following file-writing operation: ```python def save_itinerary_to_file(itinerary, output_file="travel_itinerary.json"): with open(output_file, 'w', encoding='utf-8') as f: json.dump(itinerary, f, indent=2, ensure_ascii=False) ``` ### Technical Analysis The `destination` command-line argument is incorporated directly into an output filename. The code does not reject absolute paths, path separators, `..` components, or other filesystem metacharacters. Because Python's `open(..., "w")` follows the constructed path and truncates an existing file, a destination containing traversal components can cause the itinerary to be written outside the intended working directory. The fixed `_itinerary_days.json` suffix limits which filenames can be targeted, but it does not confine writes to an approved directory. ### Attack Path 1. An attacker gains control over the destination argument, directly or through an application that invokes the script. 2. The attacker supplies a traversal value such as `../shared/report`. 3. The script constructs a path similar to: ```text ../shared/report_itinerary_5days.json ``` 4. `save_itinerary_to_file` opens the path in write mode. 5. A file outside the intended output directory is created or an existing matching file is overwritten. ### Impact Assessment Exploitation grants filesystem ...[truncated 476 chars]- Remediation
View remediation