Pensar - auto fix for Unsanitized Path Traversal in Social Profile Creation

[pensarappdev]

Directory Traversal Fix in Profile.create_social_profile_sns and Profile.create_social_profile_tweepy:

• Location of Vulnerability: The original code took the outdir and user parameters directly from input and concatenated them with other path fragments to create file paths for both reading and writing data—without any validation. This allowed for potential path traversal attacks by supplying malicious values for either parameter.
• Remediation Steps:
  • Added safe base directories (self.safe_outdir_base, self.safe_embedding_base) for allowed storage locations.
  • Introduced helper methods:
    • _safe_join(base_dir, *paths) to securely join path fragments and verify the result stays within the intended base directory.
    • _sanitize_username(user) to reject usernames containing path separators, traversal, or other suspicious input.
    • _sanitize_outdir(outdir) to ensure the output directory is a subdirectory of the designated safe base.
    • _sanitize_embedding_path(embedding_path) to guarantee embeddings are .npy files inside the embeddings directory and forbid path traversal/absolute paths.
  • All file operations for both tweet data and embeddings now use these sanitized methods, blocking malicious paths.
  • The main method logic was updated to use these sanitization helpers wherever filesystem paths are constructed or used.
  • Cluster label paths are constructed securely as well, using the safe join and explicit username sanitization.

Other Key Points:

• The changes do not affect application logic beyond adding validation for file paths.
• All file reading/writing that previously used user or input-supplied directories/filenames now validate their inputs, fully neutralizing the described directory traversal attack vectors.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-400, ML08, CWE-22	Both outdir and user originate from external input and are concatenated directly into file-system paths without any sanitization or normalization. An attacker could supply values such as outdir="../../../../etc" or user="../malicious" and cause the program to read from or write to arbitrary locations on the host. This enables directory traversal, overwriting critical files, or exfiltrating sensitive data.	high	Link