External variable 'data_path' used in file path
15 # Get file date
16 file_date.get()
17
18 media_data = json.load(open(os.path.join(data_path, file + '.json'))) # change to data dir for production19
20 data_photo_time = media_data.get('photoTakenTime', '')
21External variable 'data_path' used in file path
10
11def process_image(media_path, data_path, final_path, file):
12 print(f"Running process_image for file: {file} with supported file types: {SUPPORTED_FILE_TYPES}")
13 media_data = json.load(open(os.path.join(data_path, file + '.json')))14 data_title = media_data.get('title', '')
15 data_photo_time = media_data.get('photoTakenTime', '')
16 data_location = media_data.get('geoData', '')
Description
Python's open() function can take in a relative or absolute path and read its file contents.
If a user is provided direct access to the path that is opened, it can have serious security risks.
Bad practice
def read_file(path):
with open(os.path.join('some/path', path)) as f:
f.read()
# Someone can exploit `read_file` and see your secrets this way:
read_file('../../../secrets.txt')
Recommended
Either use a static path:
def read_file(path):
with open('some/path/to/file.txt') as f:
f.read()
Or, do some kind of validation to make sure you're not allowing arbitrary file access:
def read_file(filename):
if filename not in ('x.txt', 'y.txt'):
return 'Invalid filename'
with open(os.path.join('some/path', path)) as f:
f.read()
References
- OWASP Top 10 2021 Category A01 - Broken Access Control
- OWASP Top 10 2021 Category A04 - Insecure Design
- CWE-73 External Control of File Name or Path