Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Using `Path.rglob()` for file integrity verification or manifest creation does not descend into symlinked directories and can allow planted files beneath symlinks to evade detection. Enumerate the directory tree using `os.walk(..., followlinks=False)` and explicitly validate or reject symlinks using `os.path.islink()`.
Performing separate metadata lookups during recursive directory iteration may introduce TOCTOU race conditions.
Writing to a lock file path without verifying if it is a symbolic link using `is_link()` allows local attackers to stage symlink attacks and overwrite arbitrary files.
Relying on `os.Lstat` and checking `os.ModeSymlink` on a composite path only checks if the leaf component is a symlink, ignoring intermediate directory symlinks. This can allow path traversal or repository escape. To validate confinement safely, resolve the entire path using `filepath.EvalSymlinks` before comparing paths.
File operation relies on incomplete daemon/chroot state checks rather than checking active relative path confinement or using race-free directory file descriptor operations. This can expose path resolution to TOCTOU symlink races.
Relying on openat2 with RESOLVE_BENEATH or O_RESOLVE_BENEATH flags for relative path confinement can leave path resolution vulnerable to symlink race conditions and path traversal escapes. Use explicit per-component directory traversal with openat and O_NOFOLLOW on held dirfds instead.
Filesystem operations should be performed using `os.Root` methods (e.g., `OpenFile`, `Create`) rather than joining `root.Name()` with paths and passing them to unconfined `os` package functions. Operating on raw paths bypasses directory confinement and allows path traversal or symlink escapes.
`shutil.rmtree` silently fails on symlinks when `ignore_errors=True` is provided. If the target path is a symlink rather than a directory, it is left intact. Subsequent operations (such as extracting an archive or writing files) to this path can inadvertently follow the symlink, potentially leading to arbitrary file write vulnerabilities or privilege escalat
File path constructed from input components is accessed without resolving symlinks and ensuring the target remains within the intended root directory.
File accessed directly within an instance root directory using unconfined os file operations. Symlinks within untrusted container or instance filesystems can escape to the host filesystem. Use os.OpenRoot to confine file access to the instance directory.
Lexical path checks (e.g., checking `os.path.isabs` or `..` substrings) do not protect against symlink traversal or canonicalization bypasses. Use `os.path.realpath` or `Path.resolve` and check containment (e.g., `os.path.commonpath` or `Path.is_relative_to`) against the base directory.
Writing files directly into an instance or container root directory using os.Create or os.OpenFile without directory confinement (e.g., os.OpenRoot) can allow symlink traversal and arbitrary host file overwrite.
Directory containment checks relying on custom path normalization without resolving symbolic links via realpath() can be bypassed using symlinks. Ensure realpath() is called on the target path before checking directory containment.
Lexical path checks (such as checking for '..' or os.path.isabs) do not prevent symlink-based path traversal. Validate that the resolved target path is strictly contained within the expected root directory using Path.resolve() and is_relative_to or os.path.commonpath.
Extraction of tar files using a path traversal check that utilizes `os.path.abspath` instead of `os.path.realpath`, or iterates over members without checking for symbolic links (`issym()` or `islnk()`), allows attackers to bypass path traversal protections. An attacker can craft a malicious tar file with symlinks that point outside the target directory, lead
When resolving non-existent paths for scope validation or path checks, falling back to filepath.Dir without checking if the target is a dangling symlink (e.g. using os.Lstat or os.Readlink) can allow path scope traversal via dangling symlinks.
Direct call to os.Remove or os.RemoveAll on cached path keys within a cache eviction callback bypasses scoped filesystem controls and can lead to arbitrary file deletion via symlinks.
Untrusted symlink target from archive metadata is passed directly to `os.Symlink` without verifying that the target resolves within the destination directory. This can lead to arbitrary file overwrite via symlink traversal (CWE-59 / CWE-22).
Reading files from a cloned Git repository directly with os.ReadFile without symlink inspection or bounded reading can cause denial of service via symlink loops, FIFO pipes, or special devices like /dev/zero.
Constructing destination paths on the host by concatenating a jail or container host root path with target paths allows guest-controlled symlinks to escape the jail/container boundary (CWE-59). File operations should be performed inside the isolated guest environment (e.g. via jexec or chroot).
Insecure filesystem scoping or unsafe manual symlink checks detected. Using `afero.NewBasePathFs` directly on struct fields or implementing exported manual TOCTOU checks with `filepath.EvalSymlinks` allows attackers to bypass directory restrictions and escape scopes. Encapsulate filesystem access in safe abstractions and avoid exported manual TOCTOU checks.
Delegating path containment to openat2 with RESOLVE_BENEATH is susceptible to TOCTOU symlink race conditions. Use a step-by-step held dirfd-stack resolver with O_NOFOLLOW to safely traverse directory paths.
Gating secure path resolution or symlink confinement checks solely on daemon mode bypasses security protections for non-daemon receiver processes, exposing file operations to symlink path traversal vulnerabilities.
Archive extraction vulnerable to path traversal (Zip Slip/symlink escape). The `linkname` property from the archive header is passed directly to file-system link creation APIs without verifying that the target path resolves within the intended extraction directory. An attacker can craft an archive with malicious links to overwrite or read sensitive files. En
