T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:43- Finding
Plaintext API Key Persistence and Unsafe Environment File Construction
- Content
View full analysis
bool: """将API key保存到.env文件""" try: env_path = Path(".env") lines = [] if env_path.exists(): lines = env_path.read_text(encoding="utf-8").splitlines() found = False new_lines = [] for line in lines: if line.startswith("XBY_APIKEY="): new_lines.append(f"XBY_APIKEY={api_key}") found = True else: new_lines.append(line) if not found: new_lines.append(f"XBY_APIKEY={api_key}") env_path.write_text("\n".join(new_lines) + "\n", encoding="utf-8") os.environ["XBY_APIKEY"] = api_key return True except Exception as e: print(f"保存API key失败: {e}") return False ``` ### Technical Analysis The function persists an API credential directly into a project-level `.env` file as plaintext. It does not explicitly create the file with restrictive permissions or verify the permissions of an existing file. Consequently, the credential's confidentiality depends on the process umask, filesystem configuration, and pre-existing file permissions. The supplied value is interpolated into the environment file without rejecting carriage-return or newline characters. A crafted value containing `\n` or `\r\n` can therefore introduce additional environment-file entries or corrupt the file's structure. Although `set_api_key()` strips leading and trailing whitespace, it does not reject newline characters embedded in the value. The same secret is also copied into the process environment. This may make it accessible to other code running in the same process and, depending on the operating system and process permissions, to process-inspection m ...[truncated 1541 chars]- Remediation
View remediation