T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/src/core/storage.ts:58- Finding
Exported Storage Utilities Permit Filesystem Path Traversal
- Content
View full analysis
( data: T, category: string, operation: string, extraInfo?: string ): string { const settings = getSettings(); const categoryDir = join(settings.resultsDir, category); // Ensure category directory exists if (!existsSync(categoryDir)) { mkdirSync(categoryDir, { recursive: true }); } // Build filename const timestamp = getTimestamp(); const sanitizedOperation = sanitizeFilename(operation); const sanitizedExtra = extraInfo ? `__${sanitizeFilename(extraInfo)}` : ''; const filename = `${timestamp}__${sanitizedOperation}${sanitizedExtra}.json`; const filepath = join(categoryDir, filename); // Build wrapped result const result: SavedResult = { metadata: { savedAt: new Date().toISOString(), category, operation, propertyId: settings.propertyId, ...(extraInfo && { extraInfo }), }, data, }; // Write to file writeFileSync(filepath, JSON.stringify(result, null, 2), 'utf-8'); return filepath; } export function loadResult(filepath: string): SavedResult | null { if (!existsSync(filepath)) { return null; } try { const content = readFileSync(filepath, 'utf-8'); return JSON.parse(content) as SavedResult; } catch { return null; } } export function listResults(category: string, limit?: number): string[] { const settings = getSettings(); const categoryDir = join(settings.resultsDir, category); if (!existsSync(categoryDir)) { return []; } const files = readdirSync(categoryDir) .filter(f => f.endsWith('.json')) .map(f => join(categoryDir, f)) .sort((a, b) => { const nameA = a.split('/').pop() || ''; co ...[truncated 3412 chars]- Remediation
View remediation