T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:57
- Finding
- Arbitrary Local Files Can Be Uploaded Without Image Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py`, lines 57–76 and 158–159 **Vulnerability Type**: Insufficient input and file-type validation **Risk Level**: Medium ### Vulnerable Code ```python if os.path.isfile(value): with open(value, "rb") as f: raw = f.read() # If the file content is already Base64 text, use it directly try: raw_str = raw.decode("utf-8").strip() base64.b64decode(raw_str, validate=True) return raw_str except (UnicodeDecodeError, ValueError): pass # Otherwise, encode the binary file as Base64 if len(raw) > MAX_IMAGE_SIZE_BYTES: print( f"Error: Image file exceeds the " f"{MAX_IMAGE_SIZE_BYTES // (1024 * 1024)}MB limit", file=sys.stderr, ) sys.exit(1) encoded = base64.b64encode(raw).decode("utf-8") return encoded ``` The returned content is subsequently assigned directly to the OCR request: ```python elif args.image_base64: req.ImageBase64 = load_image_base64(args.image_base64) ``` ### Technical Analysis The `--image-base64` argument accepts either Base64 data or an arbitrary local file path. When the supplied value points to an existing file, the script reads the complete file and sends its Base64 representation to Tencent Cloud through the OCR request. The implementation only applies a size limit. It does not verify that the selected file is a supported PNG, JPEG, or BMP image through magic-byte inspection or trusted image decoding. It also accepts any syntactically valid Base64 text file without verifying that the decoded bytes represent an image. Base64 encoding does not protect confidentiality; it merely changes the representation of the source bytes. Consequently, a non-image file containing credentials, configuration, tokens, or other private information can be encoded and transmitted to the external OCR service. This behavior is related to the declared OCR function beca ...[truncated 1525 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate decoded content before transmission using both file signatures and a trusted image decoder. 2. Allow only the formats documented by the Skill, such as PNG, JPEG, and BMP. 3. Reject Base64 text unless its decoded bytes successfully validate as a supported image. 4. Apply the size limit to decoded image bytes in every input path, including Base64 text files. 5. Where practical, restrict local inputs to an explicitly approved working directory. 6. Require explicit user confirmation before uploading a local file, displaying its canonical path, detected format, and destination. 7. Clearly disclose that local image content is sent to Tencent Cloud for processing. 8. Add tests confirming that text files, credential files, malformed images, polyglot files, and Base64-encoded non-image data are rejected. ]]>