T09 · Insecure Skill Coding Practices
- Location
12306_client.py:48- Finding
Browser Session Cookies Stored in a Predictable Plaintext File
- Content
View full analysis
Vulnerability Details
File Location:
12306_client.py, lines 48–51
Vulnerability Type: Plaintext storage of sensitive session data
Risk Level: MediumVulnerable Code
python def save_cookies(self): try: with open(self.cookie_file, "w", encoding="utf-8") as f: json.dump(self.page.context.cookies(), f, ensure_ascii=False, indent=2) except: passTechnical Analysis
The application serializes all cookies from the Playwright browser context into a predictable file named
12306_cookies.jsonby default. The file is stored without encryption, access-control validation, or explicit owner-only permissions.Browser cookies may include authenticated session tokens. Although the operating system's default permissions depend on the process umask, the implementation does not ensure that only the account running the application can read the resulting file. The predictable working-directory location also increases the likelihood that the file will be included in backups, shared workspaces, archives, or source-control commits.
The broad exception handler suppresses write failures and prevents users from recognizing that cookie persistence has not been secured or completed correctly.
Attack Path
- A user runs the client and establishes an authenticated 12306 browser session.
login()invokessave_cookies(), which writes the browser-context cookies to12306_cookies.json.- A local process, another user with access to the directory, a backup system, or a recipient of an accidentally committed/archive copy obtains the file.
- The exposed authentication cookies are imported into another compatible browser context.
- If the cookies remain valid and the service does not reject the replay, the attacker can impersonate the affected session.
This path requires access to the generated cookie file; the audited code does not itself transmit the cookies to an external party.
Impact Assessment
Su ...[truncated 543 chars]
- Remediation
View remediation
Remediation Suggestions
- Avoid persistent session storage unless it is essential to the workflow.
- Store authentication state in an operating-system credential store or another encrypted secret-storage facility.
- If file persistence is unavoidable:
- Use an absolute path inside a user-private application-data directory.
- Create the file atomically with owner-only permissions such as
0600. - Verify existing file ownership and permissions before reading or overwriting it.
- Apply a restrictive process umask.
- Save only the minimum cookies required rather than every cookie in the browser context.
- Add
12306_cookies.jsonand equivalent authentication-state files to.gitignoreand packaging exclusions. - Delete the cookie file during logout and document how users can revoke exposed sessions.
- Replace the bare
exceptblock with specific exception handling and report failures without logging cookie values. - Add tests that verify restrictive permissions and ensure sensitive cookie data is never printed or committed.