T09 · Insecure Skill Coding Practices
Warning
- Location
middlewares/transaction.py:41- Finding
Path Traversal Through Unvalidated Session Identifiers
- Content
View full analysis
500: raise ValueError(f"max_results out of range: {self.max_results}") if self.timeout < 30 or self.timeout > 3600: raise ValueError(f"timeout out of range: {self.timeout}") ``` `middlewares/transaction.py:41-48` uses the identifier directly when constructing the WAL path: ```python def __init__(self, wal_dir: Optional[Path] = None): from pathlib import Path as _Path import os as _os self.wal_dir = wal_dir or _Path(_os.path.expanduser("~")) / ".uia" / "wal" self.wal_dir.mkdir(parents=True, exist_ok=True) def write(self, entry: WALEntry): wal_file = self.wal_dir / f"{entry.session_id}.wal" ``` `middlewares/transaction.py:57-61` also uses it when reading WAL data: ```python def read(self, session_id: str) -> list[WALEntry]: wal_file = self.wal_dir / f"{session_id}.wal" if not wal_file.exists(): return [] ``` `middlewares/transaction.py:88-92` uses the same unsafe path construction ...[truncated 2886 chars]- Remediation
View remediation
str: if not SESSION_ID_PATTERN.fullmatch(value): raise ValueError("Invalid session identifier") return value ``` 4. Add defense-in-depth containment checks before every file operation: ```python def contained_path(base: Path, filename: str) -> Path: base = base.resolve() target = (base / filename).resolve() if target.parent != base: raise ValueError("Path escapes the permitted directory") return target ``` 5. Apply the checks consistently to: - WAL reads, writes, and deletion. - Report generation. - Side-effect logs. - Temporary-directory prefixes. 6. Add tests for `../`, absolute paths, backslashes, URL-encoded traversal, long identifiers, Unicode separator variants, and platform-specific drive paths. ]]>