T09 · Insecure Skill Coding Practices
Error
- Location
src/media.ts:139- Finding
Remote Path Traversal Allows Arbitrary File Writes Outside the Media Cache
- Content
View full analysis
{ const ext = fileExt.startsWith(".") ? fileExt : `.${fileExt}`; const cachedPath = path.join(this.cacheDir, `${ipfsHash}${ext}`); if (fs.existsSync(cachedPath)) return cachedPath; const encryptedData = await this.ipfs.download(ipfsHash, preferredIp); const key = Buffer.from(keyBytes); const decrypted = decrypt(encryptedData, key, nonceSize); fs.writeFileSync(cachedPath, decrypted); return cachedPath; } ``` ```ts // src/media.ts:160-169 saveInlineAudio(messageId: string, content: string, fileExt = "aac"): string { const ext = fileExt.startsWith(".") ? fileExt : `.${fileExt}`; const localPath = path.join(this.cacheDir, `${messageId}${ext}`); const match = content.match(/^!\[audio\]\(data:[^;]+;base64,(.+)\)$/s); const rawBase64 = match ? match[1] : content; fs.writeFileSync(localPath, Buffer.from(rawBase64, "base64")); return localPath; } ``` ### Technical Analysis The receive path treats `messageId`, `options.ipfsHash`, and `options.fileExt` as trusted path components. These values originate in an incoming NKN message and are not constrained by a runtime schem ...[truncated 2765 chars]- Remediation
View remediation