通过用户控制的文件路径创建未经验证的任意目录
作者: geo-chen创建于 2026年7月5日更新于 2026年7月5日
In src/webui/components/browser_use_agent_tab.py, the run_agent_task function reads four path values from user-supplied component data and passes them directly to os.makedirs:
# browser_use_agent_tab.py lines 395-411
save_recording_path = get_browser_setting("save_recording_path") or None
save_trace_path = get_browser_setting("save_trace_path") or None
save_agent_history_path = get_browser_setting(
"save_agent_history_path", "./tmp/agent_history"
)
save_download_path = get_browser_setting("save_download_path", "./tmp/downloads")
...
os.makedirs(save_agent_history_path, exist_ok=True)
if save_recording_path:
os.makedirs(save_recording_path, exist_ok=True)
if save_trace_path:
os.makedirs(save_trace_path, exist_ok=True)
if save_download_path:
os.makedirs(save_download_path, exist_ok=True)No path normalization, allowlist check, or containment validation is applied to any of these values. Compare this to the Deep Research agent tab, which does validate its save directory:
# deep_research_agent_tab.py lines 78-83 (correctly validated)
safe_root_dir = "./tmp/deep_research"
normalized_base_save_dir = os.path.abspath(os.path.normpath(base_save_dir))
if os.path.commonpath([normalized_base_save_dir, os.path.abspath(safe_root_dir)]) != os.path.abspath(safe_root_dir):
logger.warning(f"Unsafe base_save_dir detected: {base_save_dir}. Using default directory.")
normalized_base_save_dir = os.path.abspath(safe_root_dir)The browser agent tab has no equivalent check. The os.makedirs calls execute before LLM initialization is attempted (lines 405-411 precede the _initialize_llm call at line 414), so directory creation occurs even when the provided API key is invalid and the agent task ultimately fails.
内容来源: browser-use/web-ui