T09 · Insecure Skill Coding Practices
Error
- Location
scripts/src/core/auth-manager.ts:15- Finding
Authentication Cookies Stored as Unencrypted JSON
- Content
View full analysis
{ const cookies = await this.context.cookies(); const authState: AuthState = { cookies, lastRefreshed: Date.now() }; const cookieDir = path.join(this.dataDir, 'cookies'); await fs.ensureDir(cookieDir); const cookieFile = path.join(cookieDir, `${platform}.json`); await fs.writeFile(cookieFile, JSON.stringify(authState, null, 2)); } ``` The behavior also contradicts the encryption claim in `SKILL.md:74-78`: ```md ## Cookie Storage Cookies are stored encrypted in: - Default: `~/.ecommerce-logistics/cookies/` - Each platform has separate cookie file - Auto-refresh on expiration ``` ### Technical Analysis The application retrieves the complete authenticated browser cookie collection and serializes it directly to a JSON file. No encryption, operating-system credential store, access-control mode, or secret-separation mechanism is used. Session cookies can function as bearer credentials. An actor who obtains a valid cookie file may be able to replay its contents in another browser context and access the associated e-commerce account without completing QR authentication. The 30-day application expiration check does not revoke the underlying platform cookies and only controls whether this application loads them. The application accepts a custom `--data-dir`, which also makes it possible for a user to accidentally select a shared, synchronized, backed-up, or otherwise exposed directory. ### Attack Path 1. The user performs QR authentication for Taobao, JD, PDD, or Douyin. 2. `saveCookies()` obtains all cookies from the authenticated browser context. 3. The cookies are written as readable plaintext JSON under `/cookies/.json`. 4. A local process, another a ...[truncated 719 chars]- Remediation
View remediation