T09 · Insecure Skill Coding Practices
Warning
- Location
- app.py:217
- Finding
- Sensitive Medical Records Stored in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `app.py:217-239` **Vulnerability Type**: Plaintext storage of sensitive health information **Risk Level**: Medium ### Vulnerable Code ```python CREATE TABLE IF NOT EXISTS profiles ( user_id INTEGER PRIMARY KEY, age INTEGER, gender TEXT, heart_disease TEXT, ef INTEGER, comorbid TEXT, resting_hr INTEGER, resting_bp_sys INTEGER, resting_bp_dia INTEGER, medications TEXT, updated_at TIMESTAMP, FOREIGN KEY(user_id) REFERENCES users(id) ); CREATE TABLE IF NOT EXISTS daily_logs ( id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, log_date DATE, symptoms TEXT, hr INTEGER, bp_sys INTEGER, bp_dia INTEGER, exercise_min INTEGER, exercise_type TEXT, notes TEXT, UNIQUE(user_id, log_date), FOREIGN KEY(user_id) REFERENCES users(id) ); ``` The application subsequently writes these records directly to SQLite without encryption: ```python c.execute( '''INSERT OR REPLACE INTO profiles (user_id, age, gender, heart_disease, ef, comorbid, resting_hr, resting_bp_sys, resting_bp_dia, medications, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,CURRENT_TIMESTAMP)''', (session['user_id'], age, request.form.get('gender'), request.form.get('heart_disease'), ef, request.form.get('comorbid'), resting_hr, resting_bp_sys, request.form.get('resting_bp_dia'), request.form.get('medications'))) ``` ```python c.execute( '''INSERT OR REPLACE INTO daily_logs (user_id, log_date, symptoms, hr, bp_sys, bp_dia, exercise_min, exercise_type, notes) VALUES (?,?,?,?,?,?,?,?,?)''', (session['user_id'], log_date, request.form.get('symptoms'), hr, bp_sys, bp_dia, exercise_min, request.form.get('exercise_type'), '')) ``` ### Technical Analysis The SQLite database contains diagnoses, symptoms, medications, ejection fraction, blood pressure, heart rate, and exercise history in plaintext. The applicatio ...[truncated 1642 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store the database in a dedicated application-data directory that is not web-accessible. 2. Create the directory with owner-only permissions and enforce mode `0600` on the database and associated SQLite journal or WAL files. 3. Run the service under a dedicated, unprivileged operating-system account. 4. Use database or field-level encryption for sensitive medical fields when the deployment threat model includes local filesystem compromise. 5. Keep encryption keys outside the database and source tree, preferably in an operating-system secret store or managed key service. 6. Minimize collected data and define explicit retention and deletion controls. 7. Encrypt backups and restrict access to backup locations. 8. Document that SQLite data is sensitive medical information and provide secure deployment guidance. 9. Test database, journal, backup, and export permissions as part of deployment validation. ]]>