T09 · Insecure Skill Coding Practices
Error
- Location
adapter/direct.py:59- Finding
Unauthenticated and Unencrypted Direct Messaging Permits Sender Spoofing
- Content
View full analysis
bool: """Synchronously send to the target address.""" if not address or ":" not in address: logger.warning(f"[{self.node_id}] Invalid address: {address}") return False host, port_str = address.split(":") port = int(port_str) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5.0) sock.connect((host, port)) data = json.dumps(payload, ensure_ascii=False).encode('utf-8') sock.sendall(data) sock.close() return True except Exception as e: logger.error(f"[{self.node_id}] Send failed to {address}: {e}") return False ``` A second DirectAdapter implementation also contains a potentially broader listener: ```python host = "0.0.0.0" self._server = await asyncio.start_server(self._handler, host, self.listen_port) actual_port = self._server.sockets[0].getsockname()[1] self._address = f"127.0.0.1:{actual_port}" ``` This appears at `adapter/clawphone.py:76-81`. Although the exported `start_direct_mode` currently imports the impl ...[truncated 2493 chars]- Remediation
View remediation