T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- monitor_v2.py:31
- Finding
- Undisclosed System-Wide Mouse Click Monitoring## Vulnerability Details **File Location**: `monitor_v2.py`, lines 31–50; automatic activation at lines 158–163 **Vulnerability Type**: Global input monitoring beyond the documented task scope **Risk Level**: Medium The monitor installs a system-wide mouse listener and records the timestamp, absolute screen coordinates, and button associated with every mouse press. It does not restrict collection to the game window. The behavior is automatically enabled when the monitor starts and is not disclosed in `SKILL.md`. ```python def on_click(self, x, y, button, pressed): """点击事件""" if pressed: # 只记录按下 click_info = { "time": time.time(), "x": x, "y": y, "button": str(button) } self.clicks.append(click_info) self.last_click_time = click_info["time"] def start(self): """启动监听""" self.listener = mouse.Listener(on_click=self.on_click) self.listener.daemon = True self.listener.start() print("鼠标监听已启动") ``` The listener is started automatically as part of monitor initialization: ```python # 启动鼠标监听 try: self.mouse.start() except Exception as e: print(f"鼠标监听失败: {e}") ``` ### Technical Analysis `pynput.mouse.Listener` registers a global input listener rather than a listener scoped to one application. Consequently, `on_click()` receives mouse events generated while the user interacts with any visible application. The callback stores raw absolute coordinates and button values without checking whether the event occurred inside the selected game window. This exceeds the least-privilege requirements of the documented screen-capture, OCR, and DPS-monitoring functionality. A safer implementation is demonstrated elsewhere in the project by `online_monitor.py`, which checks events against the game-window rectangle before retaining them. The retained queue is bounded to 100 entries and no network t ...[truncated 1613 chars]
- Remediation
- ## Remediation Suggestions 1. Remove mouse monitoring if it is not essential to the documented DPS-monitoring function. 2. If mouse monitoring is required, make it explicitly opt-in and clearly disclose that the underlying library creates a global operating-system listener. 3. Obtain and retain the selected game-window bounds before starting the listener. 4. Reject events outside those bounds before creating or storing an event record: ```python def on_click(self, x, y, button, pressed): if not pressed or not self.window_rect: return wx = self.window_rect["x"] wy = self.window_rect["y"] ww = self.window_rect["w"] wh = self.window_rect["h"] if not (wx <= x < wx + ww and wy <= y < wy + wh): return self.clicks.append({ "time": time.time(), "x": x - wx, "y": y - wy, "button": str(button) }) ``` 5. Prefer aggregate counts over raw timestamps, coordinates, and button details when precise event data is unnecessary. 6. Minimize retention and clear the queue when monitoring stops. 7. Ensure the listener is stopped through a `finally` block so exceptions cannot leave input monitoring active longer than intended. 8. Update `SKILL.md` to document the input-monitoring behavior, its purpose, collection scope, retention policy, and method for disabling it. 9. Add tests confirming that clicks outside the game-window rectangle are never retained.