T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:66
- Finding
- Arbitrary Local File Contents Can Be Transmitted to the OCR Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:66-81`, with transmission at `scripts/main.py:213-243` **Vulnerability Type**: Insufficient file-type validation leading to unintended sensitive-data disclosure **Risk Level**: Medium ### Vulnerable Code ```python if os.path.isfile(value): with open(value, "rb") as f: raw = f.read() try: raw_str = raw.decode("utf-8").strip() base64.b64decode(raw_str, validate=True) return raw_str except (UnicodeDecodeError, ValueError): pass encoded = base64.b64encode(raw).decode("utf-8") if len(raw) > MAX_IMAGE_SIZE_BYTES: sys.exit(1) return encoded ``` The resulting content is assigned to the OCR request and sent to Tencent Cloud: ```python elif args.image_base64: req.ImageBase64 = load_image_base64(args.image_base64) try: resp = client.IDCardOCR(req) except TencentCloudSDKException as e: sys.exit(1) ``` ### Technical Analysis The `--image-base64` argument accepts either a Base64 value or any path for which `os.path.isfile()` returns true. When a path is supplied, the script reads the complete file. If the content is not already valid Base64 text, it Base64-encodes the raw bytes and submits them through the Tencent Cloud OCR SDK. Base64 encoding is a normal and documented transport mechanism for the OCR API, so the encoding operation is not inherently covert or malicious. However, the implementation does not verify that the selected file is actually an image. It does not check a trusted MIME type, image signature, supported format, or successful decoding through an image parser. Consequently, any readable file smaller than the 10 MB limit can be placed into the outbound OCR request. This exceeds the minimum file access needed for the declared ID-card image recognition functionality. ### Attack Path 1. An attacker gains influence over the arguments used to invoke the Skill, such as by supplying an untrusted path ...[truncated 1323 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Verify the content as an image before assigning it to `req.ImageBase64`. 2. Decode the file through a trusted image-processing library and reject content that cannot be parsed as a supported image format. 3. Allow only the image formats supported by the OCR API, such as JPEG or PNG, and verify both the detected format and file signature. 4. Apply the size limit before Base64 encoding and before retaining the entire file in memory. 5. Do not rely solely on filename extensions or caller-provided MIME types. 6. Where feasible, restrict local input to an explicitly approved directory and resolve paths with `realpath` before validating that boundary. 7. Clearly warn users that supplied ID-card images are transmitted to Tencent Cloud and may contain highly sensitive personal information. 8. Add automated tests confirming that text files, credential files, symbolic-link escapes, malformed images, and unsupported formats are rejected. ]]>