T09 · Insecure Skill Coding Practices
Error
- Location
scripts/product_scene_swap.py:264- Finding
Server-Controlled Task Identifier Allows Output Path Traversal
- Content
View full analysis
.png` suffix, which limits which existing filenames can be directly targeted, but an attacker can still create files outside the intended directory or overwrite matching paths. If a matching destination is a symbolic link, the write operation also follows that link and may overwrite its target. Merely requiring the download URL to use HTTPS does not establish that the returned task identifier is safe for use as a filesystem path. ### Attack Path 1. A user submits an image-generation request to the configured remote service. 2. The service, or an attacker who has compromised it, returns a crafted `taskId` containing traversal components, such as `../../outside/target`. 3. `run_swap()` accepts the value without validating its format and passes it into `poll()`. 4. When the task reports a completed item, `poll()` constructs a path such as `output_dir/../../outside/target_1.png`. 5. `save_result()` creates the escaped parent directory where permissions allow and writes remot ...[truncated 915 chars]- Remediation
View remediation