T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/material_review_audit.py:37
- Finding
- Plaintext Database Passwords May Be Copied into Audit Output## Vulnerability Details **File Location**: `scripts/material_review_audit.py:37, 156-177, 471-480, 594-601` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Complete Code Snippet ```python BASIC_FIELD_ALIASES: Dict[str, List[str]] = { # ... "database_password_note": ["密码"], } ``` ```python def _extract_basic_info(lines: List[str], tables: List[List[List[str]]]) -> Dict[str, str]: result: Dict[str, str] = {} # First pass: from table key-value pairs. kv = _extract_kv_from_tables(tables) for raw_label, raw_value in kv.items(): k = _match_alias(raw_label, BASIC_FIELD_ALIASES) if k and raw_value: result[k] = raw_value # Second pass: line-based fallback. for idx, line in enumerate(lines): key = _match_alias(line, BASIC_FIELD_ALIASES) if not key: continue value = _value_after_colon(line) if not value and idx + 1 < len(lines): nxt = lines[idx + 1] if not _looks_like_label(nxt): value = normalize_text(nxt) if value: result[key] = value return result ``` ```python structured: Dict[str, object] = { "source": { "submission_docx": str(submission_path), "template_docx": str(template_path), "review_rule_docx": str(rule_path), }, "template_items": sorted(set([x for x in tpl_lines if len(x) <= 40])), "basic_info": _extract_basic_info(sub_lines, sub_tables), "data_resources": [r.__dict__ for r in _extract_resources(sub_lines, sub_tables)], "rule_points": rule_lines, } ``` ```python structured_path.write_text( json.dumps(structured, ensure_ascii=False, indent=2), encoding="utf-8", ) ``` ### Technical Analysis The parser explicitly recognizes a document field labeled as a password and stores its value under `database_password_note`. The extracted value is retained unchanged in `basic_info` and serialized into `structu ...[truncated 1358 chars]
- Remediation
- ## Remediation Suggestions 1. Remove password-related aliases from the extraction schema unless the field's presence must be validated. 2. If presence validation is required, record only a Boolean indicator such as `password_provided: true`; never retain the value. 3. Apply centralized redaction before serialization so fields matching password, secret, token, key, or credential patterns become `[REDACTED]`. 4. Exclude sensitive fields from generated reports, logs, exceptions, and debugging output. 5. Create output files with owner-only permissions, such as mode `0600`, and create the output directory with mode `0700`. 6. Document that users must not place live credentials in review materials and should use a secure secret-delivery channel for operational handoff. 7. Review and securely delete previously generated artifacts that may contain plaintext credentials.