T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:42- Finding
API Key Stored in an Unprotected Plaintext Environment File
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True ``` The related validation only removes leading and trailing whitespace: ```python def set_api_key(api_key: str) -> bool: """设置API key并持久化到.env""" if not api_key or not api_key.strip(): return False api_key = api_key.strip() if not save_api_key_to_env(api_key): return False settings.api_key = api_key return True ``` ### Technical Analysis The supplied API key is written directly to `.env` as plaintext. The implementation does not explicitly create or enforce restrictive file permissions. Consequently, the credential may be exposed through local file access, backups, workspace sharing, or accidental source-control commits. The API key is also interpolated directly into an environment-file entry without rejecting embedded carriage-return or newline characters. Calling `strip()` does not remove newlines within the value. A crafted value such as `key-value\nADDITIONAL_SETTING=value` can therefore create additional entries in the generated `.env` file. Those entries may affect later process executions if con ...[truncated 1223 chars]- Remediation
View remediation