T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bidding_tracker/skill.py:158- Finding
Arbitrary Local File Disclosure Through the Tender Evaluation Function
- Content
View full analysis
tuple[str, str]: """Extract document text and return (content, error). Supports PDF, Word, and plain text.""" path = os.path.abspath(file_path) if not os.path.exists(path): return "", f"File does not exist: {path}" ext = os.path.splitext(path)[1].lower() if ext == '.pdf': try: from pypdf import PdfReader reader = PdfReader(path) pages = [page.extract_text() or "" for page in reader.pages] return "\n".join(pages), "" except ImportError: return "", "Missing dependency: install pypdf" except Exception as e: return "", f"PDF parsing failed: {e}" elif ext == '.docx': try: import docx doc = docx.Document(path) paragraphs = [p.text for p in doc.paragraphs if p.text.strip()] return "\n".join(paragraphs), "" except ImportError: return "", "Missing dependency: install python-docx" except Exception as e: return "", f"Word document parsing failed: {e}" else: try: with open(path, encoding='utf-8') as f: return f.read(), "" except Exception as e: return "", f"File reading failed: {e}" ``` ```python def cmd_evaluate(args, user_id: str): """Parse a tender document and assemble an analysis prompt for OpenClaw.""" if not args.file: return {"status": "error", "message": "A file path is required"} text, err = extract_document_text(args.file) if err: return {"status": "error", "message": err} if not text.strip(): ...[truncated 3310 chars]- Remediation
View remediation
Path: path = Path(candidate).resolve(strict=True) try: path.relative_to(UPLOAD_ROOT) except ValueError: raise PermissionError("The file is outside the authorized attachment directory") return path ``` 4. Reject unsupported extensions rather than treating every other file as plain text. Use an explicit allowlist such as `.pdf`, `.docx`, and `.txt`. 5. Verify that the attachment belongs to a project accessible to the requesting user. 6. Consider restricting `evaluate` to directors if managers do not require independent document evaluation. 7. Run document parsing under a minimally privileged service account with no access to unrelated credentials or host configuration. 8. Apply file-size and parser resource limits to reduce denial-of-service exposure from oversized or malformed documents. 9. Avoid returning raw document contents when only an analysis result is required; pass content through a narrowly scoped internal processing channel instead. ]]>