T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/svn_manager.py:72
- Finding
- SVN Password Exposed Through Process Arguments## Vulnerability Details **File Location**: `scripts/svn_manager.py`, lines 72-100 **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: High ### Vulnerable Code ```python def svn_auth_cmd(cmd: List[str]) -> List[str]: """Give the SVN command authentication parameters.""" if SVN_USER: cmd = cmd + ["--username", SVN_USER] if SVN_PASS: cmd = cmd + ["--password", SVN_PASS, "--no-auth-cache"] else: cmd = cmd + ["--no-auth-cache"] return cmd def run_cmd(cmd: List[str], cwd: Optional[str] = None) -> tuple: """Execute a command and return (returncode, stdout, stderr). If SVN_PASS is provided, use stdin to avoid exposing it in cmdline. """ env = None stdin_data = None if SVN_USER and SVN_PASS: cmd = cmd + ["--password-from-stdin"] stdin_data = SVN_PASS.encode() env = {**os.environ} result = subprocess.run( cmd, cwd=cwd, capture_output=True, text=True, input=stdin_data, env=env, ) ``` ### Technical Analysis `svn_auth_cmd()` appends the plaintext password to the argument vector using `--password`. Although `run_cmd()` subsequently adds `--password-from-stdin`, it does not remove the existing `--password` argument. Consequently, the password is transmitted through both stdin and the process argument vector. The comment claiming that the stdin mechanism avoids command-line exposure is inaccurate. On systems where process arguments are visible through `/proc`, process-monitoring tools, audit logs, or orchestration telemetry, another local user or monitoring service may capture the SVN password while the command is running. ### Attack Path 1. An operator configures `CODE_REVIEW_SVN_USER` and `CODE_REVIEW_SVN_PASS`. 2. A scan, synchronization, or repository information operation invokes an SV ...[truncated 808 chars]
- Remediation
- ## Remediation Suggestions - Remove `--password` and its value from `svn_auth_cmd()`. - Implement exactly one authentication path in `run_cmd()`, using `--password-from-stdin` for supported SVN versions. - Detect the installed SVN version and fail securely rather than falling back to plaintext process arguments. - Use a dedicated read-only SVN account with access only to repositories that must be scanned. - Prevent credentials from being included in debug output, exceptions, process telemetry, and audit logs. - Add an automated test that inspects the final argument list and verifies that the password value never appears in it.