T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tuta_client.py:264- Finding
Decrypted cryptographic keys and access token stored in a predictable temporary file
- Content
View full analysis
dict: return { "access_token": self.access_token, "user_id": self.user_id, "mail_address": self.mail_address, "passphrase_key": base64.b64encode(self.passphrase_key).decode() if self.passphrase_key else None, "user_group_key": base64.b64encode(self.user_group_key).decode() if self.user_group_key else None, "mail_group_key": base64.b64encode(self.mail_group_key).decode() if self.mail_group_key else None, "mail_group_id": self.mail_group_id, "created_at": datetime.utcnow().isoformat(), } def load_session(self, session_file: str): """Restore session from a JSON file.""" with open(session_file) as f: data = json.load(f) self.access_token = data["access_token"] self.user_id = data["user_id"] self.mail_address = data.get("mail_address") self.passphrase_key = base64.b64decode(data["passphrase_key"]) if data.get("passphrase_key") else None self.user_group_key = base64.b64decode(data["user_group_key"]) if data.get("user_group_key") else None self.mail_group_key = base64.b64decode(data["mail_group_key"]) if data.get("mail_group_key") else None self.mail_group_id = data.get("mail_group_id") self.session.headers["accessToken"] = self.access_token def save_session(self, session_file: str): os.makedirs(os.path.dirname(session_file) or ".", exist_ok=True) with open(session_file, "w") as f: json.dump(self._session_dict(), f, indent=2) os.chmod(session_file, 0o600) ``` The documented and command-line default is the predictable path `/tmp/tuta_session.json`: ```python p_login.add_argument("--session-file", default="/tmp/tuta_session.json") p_inbox.add_argument("--session-file", default="/tm ...[truncated 3114 chars]- Remediation
View remediation