chore(agents): Add security-review skill to agent configuration #5498
1 issue
find-bugs: Found 1 issue (1 medium)
Medium
Path traversal prevention example can be bypassed with sibling directory names - `.agents/skills/security-review/references/file-security.md:38`
The safe_join function example uses str(target).startswith(str(base)) to verify the resolved path is under the base directory. This check is flawed: if base is /uploads and an attacker crafts a path resolving to /uploads_malicious/file, the startswith check passes because /uploads_malicious.startswith(/uploads) is True. Developers copying this security guidance may inadvertently introduce path traversal vulnerabilities.
Also found at:
.agents/skills/security-review/references/modern-threats.md:373.agents/skills/security-review/references/modern-threats.md:334
Duration: 410.6s · Tokens: 1.0M in / 16.4k out · Cost: $2.53 (+extraction: $0.00, +merge: $0.00)
Annotations
Check warning on line 38 in .agents/skills/security-review/references/file-security.md
github-actions / warden: find-bugs
Path traversal prevention example can be bypassed with sibling directory names
The `safe_join` function example uses `str(target).startswith(str(base))` to verify the resolved path is under the base directory. This check is flawed: if base is `/uploads` and an attacker crafts a path resolving to `/uploads_malicious/file`, the startswith check passes because `/uploads_malicious`.startswith(`/uploads`) is True. Developers copying this security guidance may inadvertently introduce path traversal vulnerabilities.
Check warning on line 373 in .agents/skills/security-review/references/modern-threats.md
github-actions / warden: find-bugs
[RVP-GBQ] Path traversal prevention example can be bypassed with sibling directory names (additional location)
The `safe_join` function example uses `str(target).startswith(str(base))` to verify the resolved path is under the base directory. This check is flawed: if base is `/uploads` and an attacker crafts a path resolving to `/uploads_malicious/file`, the startswith check passes because `/uploads_malicious`.startswith(`/uploads`) is True. Developers copying this security guidance may inadvertently introduce path traversal vulnerabilities.
Check warning on line 334 in .agents/skills/security-review/references/modern-threats.md
github-actions / warden: find-bugs
[RVP-GBQ] Path traversal prevention example can be bypassed with sibling directory names (additional location)
The `safe_join` function example uses `str(target).startswith(str(base))` to verify the resolved path is under the base directory. This check is flawed: if base is `/uploads` and an attacker crafts a path resolving to `/uploads_malicious/file`, the startswith check passes because `/uploads_malicious`.startswith(`/uploads`) is True. Developers copying this security guidance may inadvertently introduce path traversal vulnerabilities.