T09 · Insecure Skill Coding Practices
Error
- Location
src/asp/api/state.py:75- Finding
Plaintext persistence of account passwords and session secrets
- Content
View full analysis
None: jar_list = [] for cookie in cookies.jar: jar_list.append({ "name": cookie.name, "value": cookie.value, "domain": cookie.domain, "path": cookie.path, }) self.cookie_file.write_text(json.dumps(jar_list, ensure_ascii=False, indent=2)) # ── metadata ─────────────────────────────────────────────────────── def _load_meta(self) -> dict[str, Any]: if not self.state_file.exists(): return {} try: return json.loads(self.state_file.read_text()) except Exception: return {} def _save_meta(self, meta: dict[str, Any]) -> None: self.state_file.write_text(json.dumps(meta, ensure_ascii=False, indent=2)) # ── credentials ─────────────────────────────────────────────────── def load_credentials(self) -> dict[str, str] | None: if not self.credentials_file.exists(): return None try: data = json.loads(self.credentials_file.read_text()) if data.get("email") and data.get("password"): return data except Exception: pass return None def save_credentials(self, email: str, password: str) -> None: self.credentials_file.write_text( json.dumps({"email": email, "password": password}, indent=2) ) ``` Successful authentication automatically invokes this storage behavior: ```python if result.get("authenticated"): self.state.save_credentials(email, password) ``` ### Technical Analysis The application stores account passwords as unencrypted JSON in `credentials.json`. It also writes reusable HTTP cookies and CSRF-related metadata to JSON files. No OS-bac ...[truncated 1979 chars]- Remediation
View remediation