T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/http_parse_server.py:72- Finding
Unauthenticated HTTP Parsing Service Permits Arbitrary Local Path Selection and Service Shutdown
- Content
View full analysis
dict[str, Any]: payload = runtime.status() payload.update({"server": "http", "server_version": SERVER_VERSION}) return payload @app.post("/warmup") def warmup(payload: dict[str, Any] | None = None) -> dict[str, Any]: payload = payload or {} try: runtime.ensure_loaded(debug=bool(payload.get("debug"))) except Exception: return {"ok": False, "message": runtime.last_error, "server": "http"} result = runtime.status() result.update({"server": "http", "server_version": SERVER_VERSION}) return result @app.post("/parse") def parse(payload: dict[str, Any]) -> dict[str, Any]: result = runtime.parse(payload) result["server"] = "http" result["server_version"] = SERVER_VERSION status = result.get("status") if isinstance(status, dict): status["server_transport"] = "http" status["service_version"] = SERVER_VERSION return result @app.post("/shutdown") def shutdown() -> dict[str, Any]: def _exit_later() -> None: os._exit(0) threading.Timer(0.2, _exit_later).start() return {"ok": True, "state": "shutting_down", "server": "http", "pid": os.getpid()} ``` The parsing runtime consumes request-controlled absolute paths without authorization or approved-root validation: ```python def parse(self, payload: dict[str, Any]) -> dict[str, Any]: client, model_dir = self.ensure_loaded(debug=bool(payload.get("debug"))) config = ParseConfig( file=Path(str(payload["file"])).expanduser().resolve(), out=Path(str(payload["out"])).expanduser().resolve(), ...[truncated 3097 chars]- Remediation
View remediation