T09 · Insecure Skill Coding Practices
- Location
scripts/dt_helper.sh:82- Finding
Sensitive DingTalk credentials and tokens are stored without restrictive file permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/dt_helper.sh, lines 82–93
Vulnerability Type: Insecure plaintext credential storage
Risk Level: MediumVulnerable Code
bash cfg_set() { local key="$1" local value="$2" mkdir -p "$(dirname "$CONFIG")" touch "$CONFIG" if grep -q "^${key}=" "$CONFIG" 2>/dev/null; then sed -i "s|^${key}=.*|${key}=${value}|" "$CONFIG" else echo "${key}=${value}" >> "$CONFIG" fi }The same function is used to persist reusable access tokens:
bash cfg_set DINGTALK_ACCESS_TOKEN "$token" cfg_set DINGTALK_TOKEN_EXPIRY "$((now + expire_in - 200))"bash cfg_set DINGTALK_OLD_TOKEN "$token" cfg_set DINGTALK_OLD_TOKEN_EXPIRY "$((now + expires_in - 200))"Technical Analysis
The configuration file contains the DingTalk application secret and reusable OAuth access tokens. The script creates the parent directory and file using
mkdir -pandtouch, but it does not set or verify restrictive permissions.File permissions therefore depend entirely on the invoking process's
umask. With a commonumaskof022, the configuration file can be created with mode0644, making its contents readable by other local users. The parent directory may similarly be created with mode0755.Although display commands partially mask secrets, masking output does not protect the underlying plaintext configuration file. A process that can read the file can recover the complete values.
Attack Path
- A user runs
dt_helper.sh --set,--token, or--old-token. - The helper creates
~/.dingtalk-skills/configwithout explicitly restricting its permissions. - The AppSecret or newly issued access token is written to that file in plaintext.
- Another local user or compromised process reads the configuration file.
- The attacker reuses the AppSecret to request tokens or directly reuses an unexpired cached token agains ...[truncated 853 chars]
- A user runs
- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive
umaskbefore creating credential storage:bash umask 077 -
Create and enforce secure permissions on the directory and file:
bash mkdir -p -m 700 "$(dirname "$CONFIG")" touch "$CONFIG" chmod 600 "$CONFIG" -
Verify before every read or write that the configuration path:
- Is owned by the current effective user.
- Is a regular file.
- Is not a symbolic link.
- Is not readable or writable by group or other users.
-
Write updates atomically through a securely created temporary file in the same protected directory, then rename it into place.
-
Prefer an operating-system credential manager or secret service for the AppSecret and reusable tokens.
-
Avoid persistent access-token caching when operationally feasible. If caching is required, retain only the minimum necessary token lifetime and remove expired credentials promptly.
-
Document that custom paths supplied through
DINGTALK_CONFIGmust reside in a private, trusted directory.
-