T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export_x_cookies.py:79- Finding
Plaintext Export and Insecure Storage of Reusable Browser Authentication Cookies
- Content
View full analysis
tuple[list[dict], dict[str, int]]: seen: set[tuple[str, str, str, str]] = set() exported: list[dict] = [] counts: dict[str, int] = {} for browser_name in browser_names: browser_count = 0 for domain_name in TARGET_DOMAINS: try: cookie_jar = load_browser_cookies(browser_name, domain_name) except Exception as exc: if browser_count == 0: counts[browser_name] = -1 print( f"[export_x_cookies] Skipping {browser_name} ({domain_name}): {exc}", file=sys.stderr, ) continue for cookie in cookie_jar: if not matches_x_domain(cookie): continue key = (cookie.domain, cookie.path, cookie.name, cookie.value) if key in seen: continue seen.add(key) exported.append(cookie_to_playwright(cookie)) browser_count += 1 counts[browser_name] = browser_count return exported, counts ``` ```python output_path.parent.mkdir(parents=True, exist_ok=True) output_path.write_text(json.dumps(storage_state, ensure_ascii=False, indent=2), encoding="utf-8") print(str(output_path)) print(f"cookies={len(cookies)}") ``` The documented default destination is defined at lines 19-20: ```python DEFAULT_CACHE_ROOT = Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache")) DEFAULT_CACHE_PATH = DEFAULT_CACHE_ROOT / "x-article-publisher" / "x-storage-state.json" ``` ### Technical Analysis The script decrypts or otherwise reads browser cookies thro ...[truncated 2401 chars]- Remediation
View remediation