T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:57- Finding
Arbitrary Local Files Can Be Uploaded Without Image Validation
- Content
View full analysis
MAX_IMAGE_SIZE_BYTES: print( f"Error: Image file exceeds the " f"{MAX_IMAGE_SIZE_BYTES // (1024 * 1024)}MB limit", file=sys.stderr, ) sys.exit(1) encoded = base64.b64encode(raw).decode("utf-8") return encoded ``` The returned content is subsequently assigned directly to the OCR request: ```python elif args.image_base64: req.ImageBase64 = load_image_base64(args.image_base64) ``` ### Technical Analysis The `--image-base64` argument accepts either Base64 data or an arbitrary local file path. When the supplied value points to an existing file, the script reads the complete file and sends its Base64 representation to Tencent Cloud through the OCR request. The implementation only applies a size limit. It does not verify that the selected file is a supported PNG, JPEG, or BMP image through magic-byte inspection or trusted image decoding. It also accepts any syntactically valid Base64 text file without verifying that the decoded bytes represent an image. Base64 encoding does not protect confidentiality; it merely changes the representation of the source bytes. Consequently, a non-image file containing credentials, configuration, tokens, or other private information can be encoded and transmitted to the external OCR service. This behavior is related to the declared OCR function beca ...[truncated 1525 chars]- Remediation
View remediation