T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/session.py:85- Finding
Prefix-Based Session Ownership Check Enables Cross-User Session Access
- Content
View full analysis
Optional[Dict]: """ 获取用户未完成的会话 Args: chat_id: 用户ID Returns: 最新的未完成会话或None """ ensure_data_dir() sessions = [] for filename in os.listdir(DATA_DIR): if filename.endswith('.json') and filename.startswith(str(chat_id)): filepath = os.path.join(DATA_DIR, filename) with open(filepath, 'r', encoding='utf-8') as f: session = json.load(f) sessions.append(session) if not sessions: return None # 返回最新的未完成会话 sessions.sort(key=lambda x: x['timestamp'], reverse=True) latest = sessions[0] # 检查是否真的未完成 if latest['current_index'] < latest['questions_total']: return latest return None ``` The same unsafe matching rule is present in the session-listing function: ```python def list_user_sessions(chat_id: int, include_complete: bool = False) -> List[Dict]: """ 列出用户的所有会话 Args: chat_id: 用户ID include_complete: 是否包含已完成的 Returns: 会话列表 """ ensure_data_dir() sessions = [] for filename in os.listdir(DATA_DIR): if filename.endswith('.json') and filename.startswith(str(chat_id)): filepath = os.path.join(DATA_DIR, filename) with open(filepath, 'r', encoding='utf-8') as f: session = json.load(f) if include_complete or session['current_index'] < session['questions_total']: sessions.append(session) sessions.sort(key=lambda x: x['timestamp'], reverse=True) return sessions ``` ### Technical Analysis Session files are named using the pattern `_< ...[truncated 1781 chars]- Remediation
View remediation
/.json ``` 4. Normalize channel identifiers to a strict type before using them. If identifiers may be strings, permit only an explicit safe character set or derive storage keys using a cryptographic hash. 5. Centralize authorization in a helper that resolves a session only after verifying both the canonical path and the record owner. 6. Add regression tests covering overlapping identifiers such as `12`, `123`, and `1200`, and verify that each user can only enumerate and resume their own sessions. ]]>