Pensar - auto fix for Path Traversal Vulnerability in File Writing Operations

[pensarapp]

Type	Identifier	Message	Severity	Link
Application	CWE-22	The code directly uses the filename provided in input.files to build file paths using os.path.join without adequate sanitization or validation. This could be exploited to perform a path traversal attack, potentially writing files outside the intended directory (run_folder). An attacker might supply filenames such as '../../malicious_file' to modify unintended files on the system. Although the code attempts to create directories using os.makedirs, it does not validate that the constructed path remains within the intended sandbox directory. This is a true positive vulnerability and poses a significant risk in the given context.	high	Link

The code had a path traversal vulnerability (CWE-22) in the run_locally function where filenames from user input were directly used to build file paths without proper validation. An attacker could exploit this by using filenames like "../../malicious_file" to write files outside the intended directory.

Original vulnerable code:

# Write each file
for file_item in input.files:
    file_path = os.path.join(run_folder, file_item["filename"])
    os.makedirs(os.path.dirname(file_path), exist_ok=True)
    with open(file_path, "w", encoding="utf-8") as ff:
        ff.write(file_item["content"])
        log.info(f"Writing file {file_item['filename']} to {file_path}")

To fix this, I've implemented:

1. A helper function is_safe_path that uses os.path.abspath to normalize paths and checks if the resulting file path is safely contained within the specified base directory.

2. Path validation logic in the run_locally function that:

   • Checks if each filename would result in a path within the intended directory
   • If a path traversal attempt is detected, it logs a warning and uses only the basename of the file
   • Handles edge cases like empty basenames by providing a default filename

This approach maintains the core functionality while preventing files from being written outside the intended directory. Rather than rejecting potentially malicious filenames entirely, it sanitizes them to ensure the application continues to work as expected.

[restack-app]

No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews.