T09 · Insecure Skill Coding Practices
Error
- Location
skills/ui-ux-pro-max/scripts/design_system.py:504- Finding
Path Traversal Enables Filesystem Writes Outside the Design-System Directory
- Content
View full analysis
- Remediation
View remediation
str: slug = value.strip().lower().replace(" ", "-") if not SAFE_SLUG.fullmatch(slug): raise ValueError("Invalid project or page name") return slug ``` 2. Reject absolute paths, `.` and `..` components, path separators, drive prefixes, and null characters. 3. Resolve the approved root and candidate destination, then enforce containment: ```python root = (base_dir / "design-system").resolve() target = (root / project_slug / "MASTER.md").resolve() if not target.is_relative_to(root): raise ValueError("Output path escapes the design-system directory") ``` 4. Apply the same containment check to page files. 5. Detect symbolic-link traversal where the threat model includes untrusted project directories. 6. Avoid silent overwrites. Use exclusive creation mode (`x`) or require explicit confirmation before replacing existing files. 7. Treat `--output-dir` as a privileged option and require explicit user authorization when it resolves outside the current project. 8. Add tests covering absolute paths, nested traversal, Windows drive paths, mixed separators, symbolic links, and overwrite attempts. ]]>