T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:64
- Finding
- Arbitrary Local File Content Can Be Uploaded to the OCR Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py`, lines 64–80 and 277–280 **Vulnerability Type**: Arbitrary local file read and external transmission **Risk Level**: High ### Vulnerable Code ```python if os.path.isfile(value): with open(value, "rb") as f: raw = f.read() # If the file content is already Base64 text, use it directly try: raw_str = raw.decode("utf-8").strip() base64.b64decode(raw_str, validate=True) return raw_str except (UnicodeDecodeError, ValueError): pass # Otherwise encode the binary file as Base64 if len(raw) > MAX_IMAGE_SIZE_BYTES: print(f"Error: image file exceeds the {MAX_IMAGE_SIZE_BYTES // (1024 * 1024)}MB limit", file=sys.stderr) sys.exit(1) encoded = base64.b64encode(raw).decode("utf-8") return encoded ``` The resulting content is assigned directly to the outbound Tencent Cloud OCR request: ```python if args.image_url: req.ImageUrl = args.image_url elif args.image_base64: req.ImageBase64 = load_image_base64(args.image_base64) ``` ### Technical Analysis The `--image-base64` argument is documented as accepting an image, Base64 data, or a path to an image or Base64 text file. However, `load_image_base64()` accepts any path for which `os.path.isfile()` returns true. It reads the file without validating its type, magic bytes, MIME type, or ability to decode as a supported image. For non-Base64 files, the function Base64-encodes the raw bytes. Base64 is only a transport encoding and does not provide confidentiality. The encoded content is subsequently assigned to `req.ImageBase64` and sent through the Tencent Cloud SDK to `ocr.tencentcloudapi.com`. Consequently, the program's effective file-access capability is broader than the minimum privilege required for vehicle-license OCR. Any readable file of up to 7 MB can enter the external upload path, including configuration files, environment files, SSH private keys, clou ...[truncated 1654 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate file content before constructing any network request: - Check trusted image magic bytes rather than relying on file extensions. - Decode the file with a maintained image library. - Restrict accepted formats to those supported by the OCR API, such as JPEG, PNG, and BMP. - Reject text files, archives, executables, and unknown binary formats. 2. Restrict local path access: - Resolve paths with `Path.resolve()`. - Require files to reside under an explicitly approved upload or workspace directory. - Reject paths outside that directory and consider rejecting symbolic links. - Avoid allowing arbitrary absolute paths. 3. Separate Base64 text from file-path input: - Use distinct arguments such as `--image-file` and `--image-base64`. - Validate decoded Base64 bytes as an image before transmission. 4. Apply size checks to both raw files and decoded Base64 content before processing and uploading them. 5. In agent-driven environments, require explicit user confirmation showing the resolved local path and external destination before uploading local data. 6. Clearly document that vehicle-license images and recognized personal data are transmitted to Tencent Cloud and may be subject to third-party retention and privacy policies. ]]>