T09 · Insecure Skill Coding Practices
Error
- Location
scripts/post.py:40- Finding
Reusable Authentication Cookies Stored in an Unsafe Shared Temporary File
- Content
View full analysis
Vulnerability Details
File Location:
scripts/post.py:40, 91-116;scripts/check_duplicates.py:29, 58-88
Vulnerability Type: Unsafe temporary-file handling and plaintext session-token storage
Risk Level: HighVulnerable Code
scripts/post.py:40, 91-116:python COOKIE_FILE = "/tmp/postiz-cookies.txt" def _load_cookies(self): """Load cookies from file if they exist.""" cookie_path = Path(COOKIE_FILE) if cookie_path.exists(): # Parse Netscape cookie file format with open(cookie_path) as f: for line in f: if line.startswith('#') or not line.strip(): continue parts = line.strip().split('\t') if len(parts) >= 7: self.session.cookies.set(parts[5], parts[6], domain=parts[0]) def _save_cookies(self): """Save cookies to file in Netscape format.""" with open(COOKIE_FILE, 'w') as f: f.write("# Netscape HTTP Cookie File\n") for cookie in self.session.cookies: f.write(f"{cookie.domain}\tTRUE\t{cookie.path}\t" f"{'TRUE' if cookie.secure else 'FALSE'}\t" f"{cookie.expires or 0}\t{cookie.name}\t{cookie.value}\n")scripts/check_duplicates.py:29, 58-88:python COOKIE_FILE = "/tmp/postiz-cookies.txt" def get_session(): """Get authenticated session.""" session = requests.Session() # Try to load existing cookies try: with open(COOKIE_FILE) as f: for line in f: if line.startswith('#') or not line.strip(): continue parts = line.strip().split('\t') if len(parts) >= 7: session.cookies.set(parts[5], parts[6], domain=parts[0]) except FileNotFoundError: pass # Check if auth works resp = session.get(f"{PO ...[truncated 3150 chars]- Remediation
View remediation
Remediation Suggestions
- Avoid persistent cookie storage unless it is operationally required. Prefer an in-memory
requests.Session. - If persistence is required, store the cookie jar in a private per-user state directory, such as one derived from
XDG_STATE_HOME, rather than directly under/tmp. - Create the containing directory with mode
0700. - Create the cookie file atomically with exclusive access and mode
0600, for example by usingos.open()withO_CREAT | O_EXCL | O_WRONLY | O_NOFOLLOW. - Before loading an existing file, use
os.lstat()and verify that it:- Is a regular file
- Is owned by the current effective user
- Is not a symbolic link
- Is not accessible by group or other users
- Use a random, user-specific filename if temporary storage is unavoidable.
- Delete the cookie file when the session is no longer needed and provide a logout or credential-revocation workflow.
- Apply the same hardened cookie-storage implementation to both scripts rather than maintaining duplicate implementations.
- Avoid persistent cookie storage unless it is operationally required. Prefer an in-memory