Pensar - auto fix for Path Traversal Vulnerability in AI-Generated File Handling

[pensarapp]

Type	Identifier	Message	Severity	Link
Application	CWE-73	This code constructs file paths using file names that originate from untrusted sources (generated by an AI model based on user input). Without proper validation or sanitization, an attacker may provide file names containing directory traversal sequences (e.g., '../') to write files outside the intended directory. This is a case of external control of file name or path (CWE-73), which could lead to unauthorized file overwrite or creation in sensitive locations.	high	Link

The vulnerability (CWE-73: External Control of File Name or Path) exists in the run_locally function where file paths are constructed using filenames that originate from untrusted sources (AI-generated content based on user input). Without proper validation, an attacker could exploit this to perform directory traversal attacks by including "../" sequences in filenames to write files outside the intended directory.

The fix implements several security measures:

1. Get the absolute path of the run folder once at the start to use as a reference point for security checks.

2. For the Dockerfile path:

   • Get the absolute path after joining with the run folder
   • Verify that the path is still within the run folder before writing
   • Return an error if a path traversal is detected

3. For each file in the files list:

   • Get the absolute path after joining with the run folder
   • Verify that the path is still within the run folder before writing
   • Skip the file and log a warning if a path traversal is detected

The key security check is comparing the absolute paths to ensure the final destination is within the intended directory. This approach prevents both direct and indirect directory traversal attempts while maintaining the original functionality.

[restack-app]

No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews.