T09 · Insecure Skill Coding Practices
Warning
- Location
organize_notes.py:122- Finding
Unrestricted Path Traversal in Custom Directory Names
- Content
View full analysis
- Remediation
View remediation
Path: if not name or Path(name).is_absolute(): raise ValueError("Directory name must be a non-empty relative name") if name in {".", ".."} or "/" in name or "\\" in name: raise ValueError("Directory name must contain exactly one path component") if any(ord(ch) < 32 for ch in name): raise ValueError("Control characters are not allowed") resolved_base = base.resolve() candidate = (resolved_base / name).resolve() try: candidate.relative_to(resolved_base) except ValueError: raise ValueError("Directory path escapes the notes directory") return candidate ``` Use this helper before every `mkdir` operation: ```python dir_path = safe_child(self.base_path, dir_name) dir_path.mkdir(parents=True, exist_ok=True) subdir_path = safe_child(dir_path, subdir_name) subdir_path.mkdir(parents=True, exist_ok=True) ``` ]]>