T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pptx_flex_engine.py:97- Finding
Predictable Shared Temporary File Enables Symlink and Concurrency Attacks
- Content
View full analysis
127 for c in path): tmp = os.path.join(tempfile.gettempdir(), "pptx_tpl_tmp.pptx") if os.path.exists(tmp): os.remove(tmp) shutil.copyfile(path, tmp) return Presentation(tmp) return Presentation(path) ``` ### Technical Analysis Every template whose path contains a non-ASCII character is copied to the same predictable file, `pptx_tpl_tmp.pptx`, in the system-wide temporary directory. The existence check, deletion, copy, and subsequent read are separate filesystem operations. This creates two related weaknesses: 1. **Symlink race:** A local attacker can create or replace the predictable path with a symbolic link between the deletion and copy operations. Because `shutil.copyfile()` follows symbolic links, the template data can be written to another file accessible to the victim process. 2. **Cross-request collision:** Concurrent conversions use the same temporary path. One request can overwrite the temporary template while another request is parsing it, causing template substitution, data exposure, corruption, or denial of service. The temporary file is also not removed after the presentation is loaded, potentially leaving a copy of a confidential user template in a shared location. ### Attack Path 1. A victim invokes the converter with a template whose path contains non-ASCII characters. 2. The code selects the fixed path `/tmp/pptx_tpl_tmp.pptx` or the platform-equivalent shared temporary path. 3. A local attacker monitors or repeatedly manipulates that predictable filename. 4. After the victim removes the previous file, the attacker create ...[truncated 1037 chars]- Remediation
View remediation
127 for c in path): return Presentation(path) fd, tmp = tempfile.mkstemp(prefix="pptx_tpl_", suffix=".pptx") try: os.close(fd) shutil.copyfile(path, tmp) return Presentation(tmp) finally: try: os.unlink(tmp) except FileNotFoundError: pass ``` If `python-pptx` retains lazy references to the source after construction, keep the unique temporary file for the necessary lifetime and expose an explicit cleanup mechanism rather than deleting it prematurely. ]]>