T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wx_publish.py:35- Finding
WeChat credentials and access tokens are stored without enforced restrictive permissions
- Content
View full analysis
~/.wechat_publish/config.json << 'EOF' { "app_id": "你的AppID", "app_secret": "你的AppSecret" } EOF ``` ```python CONFIG_DIR = os.path.join(os.path.expanduser("~"), ".wechat_publish") TOKEN_CACHE_FILE = os.path.join(CONFIG_DIR, "token_cache.json") ``` ```python def load_config(): """从 ~/.wechat_publish/config.json 加载 app_id 和 app_secret""" cfg_path = os.path.join(CONFIG_DIR, "config.json") if not os.path.exists(cfg_path): print(f"配置文件不存在: {cfg_path}") print("请先创建配置文件，内容如下:") print(json.dumps({"app_id": "你的AppID", "app_secret": "你的AppSecret"}, indent=2, ensure_ascii=False)) sys.exit(1) with open(cfg_path, "r", encoding="utf-8") as f: return json.load(f) ``` ```python if not force_refresh and os.path.exists(TOKEN_CACHE_FILE): with open(TOKEN_CACHE_FILE, "r", encoding="utf-8") as f: cache = json.load(f) ``` ```python os.makedirs(CONFIG_DIR, exist_ok=True) with open(TOKEN_CACHE_FILE, "w", encoding="utf-8") as f: json.dump({"time": time.time(), "token": token}, f) ``` ### Technical Analysis The documented setup stores the WeChat AppSecret in a plaintext JSON file. The script also caches the reusable WeChat access token in plaintext. Neither the setup instructions nor the implementation explicitly restricts the configuration directory to mode `0700` or credential files to mode `0600`. Consequently, actual access restrictions depend on the user's umask, pre-existing directory permissions, filesystem configuration, and backup practices. On a shared host or a system where the home directory is accessible to other accounts, another local user or compromised process may be able to read these ...[truncated 1380 chars]- Remediation
View remediation