T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/paper_analyzer.py:365
- Finding
- Unrequested Discovery and Processing of PDFs Outside the Selected Input Scope<![CDATA[ ## Vulnerability Details **File Location**: `scripts/paper_analyzer.py`, lines 365-378 **Vulnerability Type**: Violation of least-privilege filesystem access **Risk Level**: Medium ### Complete Code Snippet ```python # Alternative: Check known paths alt_search_dirs = [ "/home/user/workspace/pdf", "/home/user/workspace/网站指纹", "/home/user/workspace" ] for alt_dir in alt_search_dirs: dir_path = Path(alt_dir) if dir_path.exists(): pdfs_here = list(dir_path.glob("*.pdf")) actual_pdfs.extend(pdfs_here]) actual_pdfs = list(set(actual_pdfs)) # Deduplicate ``` The closing bracket in `actual_pdfs.extend(pdfs_here])` above is represented as found in the audited context; the operative behavior is the extension of `actual_pdfs` with PDFs discovered in fixed workspace locations. ### Technical Analysis When the requested input directory contains no PDFs or is invalid, the analyzer does not stop at the user-authorized path. Instead, it enumerates PDFs in fixed directories, including `/home/user/workspace`, without explicit consent. This exceeds the minimum filesystem scope required for the declared task. The analyzer subsequently derives metadata from discovered filenames and generates analysis files based on that information. Although the implementation does not parse PDF contents, it can expose confidential paper titles, filenames, years, and local file associations in generated output. There is no evidence that this information is transmitted externally. The risk is unauthorized local discovery and processing rather than data exfiltration. ### Attack Path 1. A user invokes `paper_analyzer.py` with an empty, incorrect, or PDF-free input directory. 2. The requested search returns no usable PDFs. 3. The script automatically searches fixed workspace directories outside the requested path. 4. Unrelated PDFs are added to `actual_pdfs`. 5. Their filenames and inferred metadata are incorporated into generated analysis reports ...[truncated 712 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all hard-coded fallback directories. 2. Restrict discovery to the path explicitly supplied through `--input-dir`. 3. If the input path does not exist, exit with a nonzero status and a clear error. 4. If no PDFs are found, report that condition and require the user to provide another path. 5. If multi-directory scanning is required, add an explicit repeatable option such as `--additional-input-dir`. 6. Display all directories that will be scanned and obtain confirmation before accessing paths not covered by the original input. 7. Resolve and validate each authorized path before traversal. 8. Add tests confirming that an empty input directory never causes access to sibling or workspace-level directories. A safer pattern is: ```python search_path = Path(args.input_dir).expanduser().resolve() if not search_path.exists(): parser.error(f"Input path does not exist: {search_path}") if search_path.is_file(): actual_pdfs = [search_path] if search_path.suffix.lower() == ".pdf" else [] else: actual_pdfs = list(search_path.glob("*.pdf")) if not actual_pdfs: parser.error(f"No PDF files found in authorized path: {search_path}") ``` ]]>