T09 · Insecure Skill Coding Practices
Error
- Location
scripts/character.py:69- Finding
Untrusted Character IDs Allow Output-Directory Traversal
- Content
View full analysis
None: path.parent.mkdir(parents=True, exist_ok=True) r = requests.get(url, stream=True) with open(path, "wb") as f: for chunk in r.iter_content(8192): f.write(chunk) ``` ### Technical Analysis The character identifier `char["id"]` is read directly from the user-selected script JSON and interpolated into an output path without validation. Python's `pathlib` does not automatically constrain a joined path to its intended parent directory. An identifier containing traversal components, such as `../../shared/avatar`, causes the generated paths to resolve outside `out_dir`. An absolute identifier can similarly replace the preceding base path after interpolation and joining. The `download()` function creates missing parent directories and writes the remote response to the resulting path. The code avoids replacing a destination that already exists because of the `out.exists()` check. However, it can still create attacker-selected files at writable locations outside the declared output di ...[truncated 1274 chars]- Remediation
View remediation