T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cart_link.py:58- Finding
Guest cart bearer token exposed through unsafe temporary files and standard output
- Content
View full analysis
Path: base = os.environ.get("TARGET_TOKEN_CACHE_DIR") if base: d = Path(base) else: d = Path(tempfile.gettempdir()) / "target-com-shopper" d.mkdir(parents=True, exist_ok=True) return d / "anonymous-token.json" ``` The token is written before restrictive permissions are applied: ```python def get_token(*, force_refresh: bool = False) -> dict[str, Any]: """Return a cached token if still valid, otherwise mint and cache a new one. The cache is a plain JSON file under TARGET_TOKEN_CACHE_DIR (or a temp dir). """ path = _cache_path() if not force_refresh and path.exists(): try: cached = json.loads(path.read_text()) exp = cached.get("_payload", {}).get("exp", 0) if exp - time.time() > EXPIRY_SKEW_S: return cached except (ValueError, KeyError, OSError): pass fresh = mint_token() try: path.write_text(json.dumps(fresh)) # Tighten perms — token grants cart write access. os.chmod(path, 0o600) except OSError: pass return fresh ``` The redirect file is created in a predictable temporary directory without explicit restrictive permissions: ```python def _default_cart_file(cart_id: str | None) -> Path: base = Path(tempfile.gettempdir()) / "target-com-shopper" base.mkdir(parents=True, exist_ok=True) suffix = cart_id or f"unknown-{int(time.time())}" return base / f"cart-{suffix}.html" ``` The redirect file contains the complete bearer URL: ```pyth ...[truncated 5946 chars]- Remediation
View remediation