T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/auto_publisher.py:49
- Finding
- Authentication session state is stored in plaintext without restrictive permissions## Vulnerability Details **File Location**: `scripts/auto_publisher.py:49-60`, with session restoration at `scripts/auto_publisher.py:106-122` **Vulnerability Type**: Plaintext storage of sensitive authentication data **Risk Level**: Medium ### Vulnerable Code ```python def load_cookies(self, platform: str) -> Optional[dict]: """Load cookies for the specified platform.""" cookies_path = self.get_cookies_path(platform) if cookies_path.exists(): return cookies_path return None def save_cookies(self, platform: str): """Save cookies from the current session.""" if self.context: cookies_path = self.get_cookies_path(platform) self.context.storage_state(path=str(cookies_path)) print(f"Saved {platform} login state") ``` The saved state is subsequently restored into a new browser context: ```python if platform: cookies_path = self.load_cookies(platform) if cookies_path: with open(cookies_path, 'r', encoding='utf-8') as f: storage_data = json.load(f) if "cookies" in storage_data: for cookie in storage_data["cookies"]: if cookie.get("sameSite") not in ["Strict", "Lax", "None"]: cookie["sameSite"] = "Lax" context_options["storage_state"] = storage_data ``` ### Technical Analysis Playwright storage-state files can contain authenticated session cookies and origin storage. The code writes this data to `config/cookies/douyin.json` as plaintext through `context.storage_state()`. The implementation does not explicitly apply owner-only file permissions, encrypt the state, verify file ownership before loading it, or prevent the cookie directory from being committed, archived, or copied. File permissions therefore depend entirely on the process environment and its default `umask`. A party that obtains this file may be able to restore the captured state in an ...[truncated 1322 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an operating-system credential store or protected secret-management facility for persistent session material. 2. If a file must be used, create it with owner-only permissions such as `0600` and create `config/cookies/` with restrictive directory permissions such as `0700`. 3. Write through a securely created temporary file, set its permissions before adding sensitive content, and atomically replace the destination. 4. Verify that the state file is a regular file owned by the expected user and is not a symbolic link before loading it. 5. Add `config/cookies/`, storage-state files, publication logs, and debug artifacts to `.gitignore` and backup-exclusion rules. 6. Avoid storing account passwords in `config/accounts.json`; remove unused credential fields or retrieve secrets from a credential manager. 7. Document session revocation and deletion procedures and provide a command that securely removes saved browser state. 8. Warn users that copying the project directory may copy an authenticated session.