T09 · Insecure Skill Coding Practices
Warning
- Location
fa_advisor/advisor.py:128- Finding
Path Traversal Allows PDF Writes Outside the Intended Output Directory
- Content
View full analysis
- Remediation
View remediation
str: value = re.sub(r"[^A-Za-z0-9_-]+", "_", value).strip("_") if not value: raise ValueError("Project name cannot produce an empty filename") return value[:100] ``` 3. **Resolve and enforce directory containment before writing:** ```python output_dir = Path("output").resolve() output_dir.mkdir(parents=True, exist_ok=True) safe_name = safe_filename(project.name) destination = (output_dir / f"{safe_name}_assessment.pdf").resolve() if output_dir not in destination.parents: raise ValueError("Invalid report destination") ``` 4. **Reject path semantics explicitly.** Company names used in filenames should not contain `/`, `\`, `..`, null bytes, drive prefixes, or absolute-path components. 5. **Avoid unintended overwrites.** Create reports using exclusive file creation or reject destinations that already exist unless an authorized caller explicitly enables replacement. 6. **Apply the same centralized helper to every generated report**, including assessment, valuation, and investment-memo output paths. 7. **Add regression tests** for names containing: - `../` - `..\` - Absolute POSIX paths - Windows drive paths - Repeated separators - Empty names after sanitization - Existing destination filenames ]]>