T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:45- Finding
API Key Persisted in a Plaintext File Without Enforced Access Restrictions
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persistently stores the supplied API key as plaintext in a relative `.env` file. `Path.write_text()` does not explicitly enforce owner-only permissions. When a new file is created, its effective permissions depend on the process umask. If that umask is permissive, other local accounts or processes may be able to read the credential. The relative path also means that the destination depends on the current working directory. The implementation does not verify that an existing `.env` is a regular file owned by the current account, nor does it reject symbolic links before overwriting the file. The confirmed primary weakness is plaintext credential storage without enforced access restrictions; unsafe destination replacement is an additional hardening concern. The API client later sends this key in the `XBY-APIKEY` request header to the configured upstream service. Consequently, disclos ...[truncated 1265 chars]- Remediation
View remediation