T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/feishu_send.py:14- Finding
Over-Privileged Credential Access Enables Arbitrary Local File Transmission
- Content
View full analysis
Tuple[str, str]: """Load Feishu configuration.""" try: with open(OPENCLAW_CONFIG, 'r') as f: config = json.load(f) channels = config.get('channels', {}) feishu = channels.get('feishu', {}) app_id = feishu.get('appId', '') app_secret = feishu.get('appSecret', '') return app_id, app_secret except Exception as e: print(f"Failed to load configuration: {e}") return '', '' ``` ```python def get_tenant_token(app_id: str, app_secret: str) -> Optional[str]: """Obtain tenant_access_token.""" url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" headers = {"Content-Type": "application/json"} data = {"app_id": app_id, "app_secret": app_secret} try: resp = requests.post(url, headers=headers, json=data, timeout=30) result = resp.json() if result.get('code') == 0: return result.get('tenant_access_token') else: print(f"Failed to obtain token: {result}") return None except Exception as e: print(f"Request failed: {e}") return None ``` ```python def upload_file(token: str, file_path: str) -> Optional[str]: """Upload a file to Feishu.""" url = "https://open.feishu.cn/open-apis/im/v1/files" ext = os.path.splitext(file_path)[1].lower() file_type_map = { '.xlsx': 'xlsx', '.xls': 'xls', '.pdf': 'pdf', '.doc': 'doc', '.docx': 'docx', '.png': 'png', '.jpg': 'jpg', '.jpeg': 'jpeg', } fi ...[truncated 4091 chars]- Remediation
View remediation