T09 · Insecure Skill Coding Practices
- Location
desensitize.py:438- Finding
Reversible Sensitive Data Is Written to a Predictable Plaintext Sidecar File
- Content
View full analysis
Vulnerability Details
File Location:
desensitize.py, lines 438–441
Vulnerability Type: Predictable plaintext storage of sensitive mappings and unsafe file creation
Risk Level: MediumVulnerable Code
python mapping_file = args.output + ".mapping.json" if args.output else args.file + ".mapping.json" with open(mapping_file, 'w', encoding='utf-8') as f: json.dump(mapping, f, indent=2, ensure_ascii=False) print(f"📊 映射表已保存到: {mapping_file}")Technical Analysis
The file-processing action automatically writes its reversible redaction mapping to either
<output>.mapping.jsonor<input>.mapping.json. The mapping can contain original IP addresses, usernames, path usernames, wildcard matches, and digit sequences. Possession of this file can therefore disclose source values that the user intended to redact.The sidecar is stored in plaintext and created using the process's default
umask, without explicitly enforcing owner-only permissions. On a shared system, this can make the mapping readable by other users depending on the environment's permission configuration.The destination is also predictable and opened with Python's normal write mode. This truncates an existing file and follows symbolic links. If an attacker can write to the destination directory before a more privileged user invokes the Skill, the attacker can create the expected mapping path as a symbolic link to another file writable by the victim. The subsequent invocation will follow that link and overwrite the target with JSON mapping data.
This issue does not independently bypass operating-system permissions: the process can only overwrite targets that its current account is already permitted to write. Exploitation of the symbolic-link condition also requires attacker write access to the directory containing the predictable sidecar path.
Attack Path
- A victim invokes the file-redaction action on a sensitive input file.
- The Skill derives a predictable ...[truncated 1299 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not write reversible mappings automatically. Require explicit user consent and a separately specified protected destination.
- Create mapping files with owner-only permissions, such as mode
0600, rather than relying on the ambientumask. - Use exclusive creation so an existing path cannot be silently truncated. For example, use
os.open()withO_WRONLY | O_CREAT | O_EXCLand mode0o600. - Where supported, add
O_NOFOLLOWand verify withlstat()orfstat()that the destination is a regular file and not a symbolic link. - Write to a securely created temporary file in the same protected directory, flush and synchronize it, and atomically rename it into place after validating the destination.
- Refuse shared or insecure destination directories unless their ownership and permissions have been verified.
- Consider encrypting reversible mappings at rest with a user-supplied key or platform credential-storage mechanism.
- Clearly warn users that mapping files contain sensitive, reversible source data and must be protected, transferred, retained, and deleted according to the same controls as the original input.
- Avoid printing sensitive mapping contents to standard output in text mode unless the user explicitly requests them and the output channel is trusted.