T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/picture_capture.py:1331- Finding
Credential Access and All-Device Capture Are Not Enforced by Runtime Authorization Checks
- Content
View full analysis
Dict[str, Any]: """执行完整的查询流程（加载配置→设备筛选→抓拍下载→整理结果）""" result = { "success": False, "message": "", "config_result": None, "device_status_result": None, "query_result": None } config_result = self._load_runtime_config_from_vpup(force_reload=True) result["config_result"] = config_result if not config_result["success"]: result["message"] = f"初始化失败: {config_result['message']}" return result device_status_result = self.query_device_status_list(force_refresh=True) result["device_status_result"] = device_status_result if not device_status_result.get("success"): result["message"] = f"获取设备状态失败: {device_status_result.get('message', '未知错误')}" return result devices = device_status_result.get("data", []) if not isinstance(devices, list): devices = [] filtered_devices = [ device for device in devices if isinstance(device, dict) and self._device_name_matches( device.get("device_name") or device.get("name"), device_name, ) ] ``` The device-name matcher treats an absent name as matching every device: ```python @staticmethod def _device_name_matches(device_name: Any, expected_name: Optional[str]) -> bool: """按设备名称过滤，支持忽略大小写的包含匹配。""" expected_text = str(expected_name or "").strip() if not expected_text: return True device_text = str(device_name or "").strip() if not device_text: return False normalized_expected = expected_text.casefold() normalized_device = device_text.casefold() return ( normalized_device ...[truncated 2334 chars]- Remediation
View remediation