T09 · Insecure Skill Coding Practices
Error
- Location
claw_security_scanner.py:178- Finding
Credential values are retained and exposed in generated reports
- Content
View full analysis
100: evidence = evidence[:100] + "..." ``` The captured value is stored directly in each finding: ```python finding = SecurityFinding( id=f"cred_{hashlib.md5(f'{file_path}:{line_number}'.encode()).hexdigest()[:8]}", category=DetectionCategory.CREDENTIALS, risk_level=risk_level, file_path=file_path, line_number=line_number, description=f"检测到潜在的凭据泄露: {match.group(1) if match.groups() else '敏感信息'}", evidence=evidence, recommendation="移除硬编码的凭据，使用环境变量或安全的配置管理系统", detector_name=self.name, fix_available=True, auto_fixable=False ) ``` Report-generation paths subsequently expose the value: ```python if format == "json": return result.to_json() ``` ```python report_lines.append(f"- **证据**: `{finding.evidence}`") ``` ```python if args.output: with open(args.output, 'w', encoding='utf-8') as f: f.write(report) ``` ### Technical Analysis The credential detector preserves the entire regular-expression match, truncating it only after 100 characters. This is not effective secret redaction: API keys, passwords, tokens, database credentials, and substantial portions of private-key-related data may fit entirely within that limit. The raw value is retained in `SecurityFinding.evidence`, exposed through the Python API, included directly in Markdown reports, and intended to be included in JSON serialization. Reports can then be written to a caller-selected file without restrictive file permissions. A security scanner only needs the credential type, source location, and safely masked context to report a finding; retaining the plaintext ...[truncated 1962 chars]- Remediation
View remediation
str: if len(value) <= 8: return "[REDACTED]" return f"{value[:4]}...[REDACTED]...{value[-4:]}" ``` 3. Prefer evidence such as `API_KEY = "[REDACTED]"` rather than masking the full matched string indiscriminately. 4. Ensure `SecurityFinding.evidence` can never contain plaintext credential material before it reaches any report generator or API consumer. 5. Create output files with owner-only permissions, such as mode `0o600`, and warn users that reports may still contain sensitive file paths and code context. 6. Avoid emitting reports to shared logs or standard output in CI unless all sensitive fields have been sanitized. 7. Add tests using sentinel secrets and assert that no complete sentinel, password, token, connection string, or private-key body appears in Markdown, JSON, console output, logs, or serialized findings. 8. Correct JSON enum serialization separately so that risk and category values are safely converted to strings without reintroducing raw secret evidence. ]]>