T09 · Insecure Skill Coding Practices
Error
- Location
scripts/spring_project_scaffolder.py:62- Finding
Project Name Path Traversal Allows Writes Outside the Selected Output Directory
- Content
View full analysis
Dict[str, Any]: """Generate the complete project structure""" logger.debug(f"Scaffolding {self.config.project_type} Spring Boot project: {self.config.name}") if self.verbose: print(f"Scaffolding Spring Boot {self.config.project_type}: {self.config.name}") print(f"Java Version: {self.config.java_version}") print(f"Database: {self.config.database}") print(f"Security: {self.config.security or 'None'}") print(f"Output: {self.output_dir}\n") # Create project directory self.output_dir.mkdir(parents=True, exist_ok=True) ``` The command-line argument is described as kebab-case but is not validated: ```python parser.add_argument("name", help="Project name (kebab-case)") ``` Generated files are subsequently written without containment or overwrite checks: ```python def _write_file(self, path: str, content: str): """Write content to a file""" file_path = self.output_dir / path file_path.parent.mkdir(parents=True, exist_ok=True) file_path.write_text(content) self.files_created.append(path) logger.debug(f"Created file: {path}") ``` ### Technical Analysis `config.name` is controlled by the command-line caller and is joined directly to the selected output directory. The code does not reject absolute paths, `..` co ...[truncated 1961 chars]- Remediation
View remediation