T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/bili_review.py:204- Finding
Automatic Broad Browser Cookie Extraction and Persistent Session Storage
- Content
View full analysis
bool: """用 yt-dlp 的 python 调用 extract_cookies.py 从指定浏览器提取 cookie. 仅提取 B站 相关域名, 不导出其他网站; 保存为 600 权限.""" try: cmd = [find_ytdlp_python(), str(SCRIPTS_DIR / "extract_cookies.py"), browser, str(output)] subprocess.run(cmd, check=True, capture_output=True, text=True, timeout=60) if output.exists() and output.stat().st_size > 0: os.chmod(output, 0o600) return True except (subprocess.CalledProcessError, FileNotFoundError): return False return False ``` ```python # scripts/bili_review.py:204-219 def get_cookie_file() -> Path: """获取有效 cookie 文件; 无则自动从浏览器提取(首次需授权一次).""" if COOKIE_FILE.exists() and validate_login(COOKIE_FILE): return COOKIE_FILE print("未检测到有效登录态, 正在从浏览器提取 cookie ...", file=sys.stderr) for browser in BROWSERS: tmp = Path(tempfile.mkdtemp()) / "cookies.txt" if extract_cookies_from_browser(browser, tmp) and validate_login(tmp): os.chmod(tmp, 0o600) tmp.replace(COOKIE_FILE) print(f"已从 {browser} 提取登录态 -> {COOKIE_FILE}", file=sys.stderr) return COOKIE_FILE raise RuntimeError( "浏览器 cookie 提取失败(弹窗被取消或无B站登录)。" f"请确认浏览器已登录B站后重试: python3 {SCRIPTS_DIR / 'bili_review.py'} login") ``` ```python # scripts/extract_cookies.py:13-29 BILI_DOMAINS = ("bilibili.com", "b23.tv", "biligame.com", "bilibili.tv", "bstar.app", "biligame.net") def main() -> None: if len(sys.argv) != 3: print("用法: extract_cookies ...[truncated 2943 chars]- Remediation
View remediation