Plugin `wordlist` / file-path inputs allow arbitrary local filesystem access (path traversal + sensitive file exposure)

[ionfwsrijan]

Summary

Plugin command rendering resolves wordlist values and passes file-like inputs directly into CLI args. Currently, callers can supply absolute paths or traversal-like values that resolve to arbitrary files on the server.

Why this is critical

• In a multi-user or remotely exposed deployment, a user can point scanners at sensitive local files (e.g., SSH keys, config, env files).
• Even if tools do not print file contents directly, they can leak data via logs, errors, or output artifacts.

Evidence (code)

• backend/secuscan/plugins.py
  • _resolve_wordlist_path() returns the candidate path if it exists, even when it is outside settings.wordlists_dir.
  • build_command() interpolates inputs into argv with no allowlist for filesystem locations.
• backend/secuscan/routes.py
  • Task creation accepts user-controlled inputs for plugins.

Proposed fix (high-level)

• Introduce a safe file policy for plugin inputs:
  • Only allow wordlists from settings.wordlists_dir (or a configured allowlist of directories).
  • Disallow absolute paths and parent traversal unless an explicit “advanced/local file” mode is enabled.
• Add an upload pipeline for user-provided wordlists/files:
  • Store uploads under a controlled directory (per-task or per-user),
  • Reference uploads by ID, not raw filesystem paths.
• Add tests for path traversal/absolute path rejection.

Acceptance criteria

• Arbitrary absolute paths cannot be passed through plugin inputs by default.
• Wordlist/file inputs are constrained to safe directories or upload IDs.
• Regression tests cover path validation and allowed cases.

[ionfwsrijan]

@utksh1 You may review and assign me this issue.