T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skills/baoyu-danger-gemini-web/scripts/gemini-webapi/utils/load-browser-cookies.ts:104- Finding
Overbroad extraction of Google authentication cookies from existing browser sessions
- Content
View full analysis
{ const discovered = await discoverRunningChromeDebugPort(); if (discovered === null) return null; if (verbose) logger.info(`Found reusable Chrome debugging session on port ${discovered.port}. Connecting via WebSocket...`); let cdp: CdpConnection | null = null; let targetId: string | null = null; let createdTarget = false; try { const connectStart = Date.now(); const connectTimeout = 30_000; let lastConnErr: unknown = null; while (Date.now() - connectStart < connectTimeout) { try { cdp = await CdpConnection.connect(discovered.wsUrl, 5_000); break; } catch (e) { lastConnErr = e; if (verbose) logger.debug(`WebSocket connect attempt failed: ${e instanceof Error ? e.message : String(e)}, retrying...`); await sleep(1000); } } if (!cdp) { if (verbose) logger.debug(`Could not connect to Chrome after ${connectTimeout / 1000}s: ${lastConnErr instanceof Error ? lastConnErr.message : String(lastConnErr)}`); return null; } const page = await openPageSession({ cdp, reusing: false, url: GEMINI_APP_URL, matchTarget: (target) => target.type === 'page' && target.url.includes('gemini.google.com'), enableNetwork: true, activateTarget: false, }); const { sessionId } = page; targetId = page.targetId; createdTarget = page.createdTarget; const start = Date.now(); let last: CookieMap = {}; while (Date.now() - start < timeoutMs) { const { cookies } = await cdp.send<{ cookies: Array<{ name: string; value: string }> }>( ...[truncated 3867 chars]- Remediation
View remediation