fix: add path validation in betaflight_target_converter.py...

[orbisai0security]

Summary

Address high severity security finding in extras/betaflight_target_converter/betaflight_target_converter.py.

Vulnerability

Field	Value
ID	utils.custom.path-traversal-open
Severity	HIGH
Scanner	semgrep
Rule	utils.custom.path-traversal-open
File	extras/betaflight_target_converter/betaflight_target_converter.py:33
Assessment	Likely exploitable

Description: User-controlled input used in file path for open() without sanitization. This can allow path traversal attacks to read arbitrary files.

Evidence

Scanner confirmation: semgrep rule utils.custom.path-traversal-open matched this pattern as utils.custom.path-traversal-open.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is embedded firmware - exploitation requires physical access or a compromised network peer on the same bus/LAN segment.

Changes

• extras/betaflight_target_converter/betaflight_target_converter.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

Security Invariant

Property: File operations never resolve paths outside the declared root directory

Regression test

import pytest
import sys
import os
from pathlib import Path

# Add the project root to sys.path to import the module
project_root = Path(__file__).parent.parent.parent
sys.path.insert(0, str(project_root))

from extras.betaflight_target_converter.betaflight_target_converter import convert_target

@pytest.mark.parametrize("payload", [
    # Exact exploit case - classic path traversal
    "../../../etc/passwd",
    # Boundary case - double dot slash with extra dots
    "....//....//etc/passwd",
    # URL encoded traversal attempt
    "%2e%2e%2fetc%2fpasswd",
    # Valid input for comparison
    "valid_target.json",
])
def test_file_operations_stay_within_root_directory(payload):
    """Invariant: File operations never resolve paths outside the declared root directory"""
    
    # Create a temporary test directory structure
    import tempfile
    with tempfile.TemporaryDirectory() as tmpdir:
        # Create a mock target file in the temp directory
        target_file = Path(tmpdir) / "valid_target.json"
        target_file.write_text('{"test": "data"}')
        
        # Create a mock output directory
        output_dir = Path(tmpdir) / "output"
        output_dir.mkdir()
        
        # Test the actual function with the payload
        try:
            # The function should either:
            # 1. Raise an exception for invalid paths
            # 2. Create files only within the allowed directory
            result = convert_target(str(target_file), str(output_dir), payload)
            
            # If no exception was raised, verify the output stays within bounds
            if result and hasattr(result, 'output_file'):
                output_path = Path(result.output_file)
                # Ensure the output path is within the output directory
                assert output_path.is_relative_to(output_dir), \
                    f"Output path {output_path} escaped root directory {output_dir}"
            
        except (ValueError, FileNotFoundError, PermissionError, OSError) as e:
            # These are acceptable exceptions for path traversal attempts
            # Verify the error indicates a security rejection
            error_msg = str(e).lower()
            assert any(keyword in error_msg for keyword in 
                      ['path', 'traversal', 'invalid', 'not found', 'permission', 'security']), \
                f"Unexpected error for path traversal payload: {e}"
            
        except Exception as e:
            # Re-raise unexpected exceptions
            pytest.fail(f"Unexpected exception type for path traversal: {type(e).__name__}: {e}")

This test guards against regressions — it's useful independent of the code change above.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security