Pensar - auto fix for Path Traversal in Twitter Profile Data Storage

[pensarappdev]

Security issue fixed: Path traversal in the use of the user parameter as a filename for reading/writing tweet data.

Details of the fix:

• Sanitization function: A new helper, sanitize_handle(user: str), ensures that Twitter handles only contain allowed (alphanumeric and underscore) characters. Any disallowed characters, path separators, or suspicious substrings such as .. raise a ValueError.
• Path builder: The function safe_user_tweet_path(outdir, user) uses the sanitized handle to build a filename, joins it with the intended output directory, and checks that the resulting absolute path resides within the expected directory (outdir). If not, a ValueError is raised.
• Code updates: All file operations that depend on user-specified handles (in both create_social_profile_tweepy and create_social_profile_sns) have been updated to use safe_user_tweet_path(). No direct string interpolation of user into file paths remains, closing the path traversal vulnerability.
• Imports: The re import was added to support regular expression checking in the sanitization function.
• Behavior: This fix will reject Twitter handles that contain characters outside of valid Twitter username constraints (alphanumeric and underscores), as well as attempts to inject directory traversal sequences or path separators, mitigating the described vulnerability.

No changes were made unrelated to the explicit issue described.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-22	File paths are built by directly interpolating the externally-controlled variable user (a Twitter handle supplied by whoever invokes the API). If user contains path separators such as "../" or an absolute path (e.g. "../../etc/passwd"), the resulting path escapes the intended outdir directory. Because the code then opens these paths for both reading and writing, an attacker could: • Read arbitrary files on the host (information disclosure) • Overwrite or create files elsewhere on the filesystem (potential denial-of-service or further compromise) No validation or sanitisation is performed to restrict user to safe characters, nor is os.path.abspath compared against an allowed base directory. This is a classic Path Traversal vulnerability.	high	Link