T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:44- Finding
API Key Persisted in a Plaintext Working-Directory File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persistently stores the user-supplied API key in a plaintext `.env` file. The file path is relative to the process's current working directory rather than a dedicated private configuration directory. The implementation does not: - Explicitly create the file with restrictive permissions such as `0600`. - Verify that an existing `.env` is a regular file rather than a symbolic link. - Use atomic file replacement. - Ensure that `.env` is excluded from source control, backups, or artifact collection. - Use an operating-system credential store or another protected secret-management mechanism. Permissions for a newly created file are consequently determined by the process umask. In a permissive or shared environment, other local accounts or processes may be able to read the credential. The relative path also makes it possible to save the key into an unintended repository or shared directory. ### Attack Path 1. A user supplies an API key as required by t ...[truncated 1158 chars]- Remediation
View remediation