T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:64- Finding
Arbitrary Local Files Can Be Encoded and Uploaded to Tencent Cloud
- Content
View full analysis
str: """ Load image Base64 content. If value is an existing file path, read the file and encode it as Base64; otherwise, treat it directly as a Base64 string. """ if os.path.isfile(value): ext = os.path.splitext(value)[1].lower() if ext not in IMAGE_EXTENSIONS: print( f"Warning: file extension '{ext}' is not in the supported list " f"{sorted(IMAGE_EXTENSIONS)}; upload will still be attempted", file=sys.stderr, ) with open(value, "rb") as f: raw = f.read() try: raw_str = raw.decode("utf-8").strip() decoded = base64.b64decode(raw_str, validate=True) _check_image_size(len(decoded)) return raw_str except SystemExit: raise except Exception: pass _check_image_size(len(raw)) return base64.b64encode(raw).decode("utf-8") else: try: decoded = base64.b64decode(value, validate=True) _check_image_size(len(decoded)) except SystemExit: raise except Exception: print( "Error: the provided content is neither valid Base64 nor a valid file path", file=sys.stderr, ) sys.exit(1) return value ``` The resulting content is then included in the external API request: ```python if args.url: params["Url"] = args.url print(f"Using image URL: {args.url}", file=sys.stderr) else: print(f"Loading image: {args.image}", file=sys.stderr) params["Image"] = load_base64_image(args.image) print("Image Base64 enc ...[truncated 2546 chars]- Remediation
View remediation