T09 · Insecure Skill Coding Practices
- Location
scripts/videogen.py:399- Finding
Server-Controlled Path Traversal in Downloaded Output Filenames
- Content
View full analysis
Vulnerability Details
File Location:
scripts/videogen.py, lines 399–413
Vulnerability Type: Path traversal and arbitrary file write
Risk Level: MediumVulnerable Code
python task_type = task.get("taskType", "task") for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # 尾帧 for item in succeeded: last_frame = item.get("lastFrameUrl") if last_frame: out_path = out_dir / f"{task_type}_{task_id}_lastframe.png" download_file(last_frame, out_path)Technical Analysis
The output filenames incorporate
taskTypereturned by the remote API andtask_idwithout validating or removing path separators,..components, or other filesystem metacharacters. The resulting value is joined directly to the user-selected output directory and opened for writing bydownload_file().A malicious or compromised API endpoint can return a crafted
taskType, such as../../.config/target, causing the resolved output path to escape the intended output directory. The same unsafe values are reused when constructing the last-frame filename.This risk is particularly relevant because the application supports a configurable API base URL. An attacker-controlled endpoint can therefore provide both the malicious task metadata and the content downloaded into the resulting path.
Attack Path
- The victim is induced to configure an attacker-controlled API base URL, or the legitimate API service is compromised.
- The victim submits or polls a generation task.
- The endpoint returns a completed task containing a traversal sequence in
taskType, such as../../target-directory/payload. - The endpoint supplies an attacker-cont ...[truncated 722 chars]
- Remediation
View remediation
Remediation Suggestions
-
Do not use server-provided task metadata as a filesystem name. Generate output names from locally generated random identifiers or strictly validated identifiers.
-
Reject values containing
/,\,.., NUL characters, control characters, or platform-specific path syntax. -
Resolve both the output directory and candidate path before writing, then verify that the candidate remains inside the output directory:
python out_dir = Path(output_dir).resolve() out_dir.mkdir(parents=True, exist_ok=True) safe_task_id = "".join( c for c in str(task_id) if c.isalnum() or c in ("-", "_") ) filename = f"video_{safe_task_id}_{i + 1}{ext}" out_path = (out_dir / filename).resolve() if out_dir not in out_path.parents: raise SystemExit("Unsafe output path") -
Apply the same validation and containment check to normal results and last-frame downloads.
-
Consider opening new files in exclusive creation mode where overwriting existing files is unnecessary.
-
Add tests using values such as
../file,../../dir/file, backslash traversal, absolute-path-like strings, and encoded separator variants.
-