T09 · Insecure Skill Coding Practices
Error
- Location
scripts/material_review_audit.py:37- Finding
Plaintext Database Passwords May Be Copied into Audit Output
- Content
View full analysis
Vulnerability Details
File Location:
scripts/material_review_audit.py:37, 156-177, 471-480, 594-601
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: HighComplete Code Snippet
python BASIC_FIELD_ALIASES: Dict[str, List[str]] = { # ... "database_password_note": ["密码"], }python def _extract_basic_info(lines: List[str], tables: List[List[List[str]]]) -> Dict[str, str]: result: Dict[str, str] = {} # First pass: from table key-value pairs. kv = _extract_kv_from_tables(tables) for raw_label, raw_value in kv.items(): k = _match_alias(raw_label, BASIC_FIELD_ALIASES) if k and raw_value: result[k] = raw_value # Second pass: line-based fallback. for idx, line in enumerate(lines): key = _match_alias(line, BASIC_FIELD_ALIASES) if not key: continue value = _value_after_colon(line) if not value and idx + 1 < len(lines): nxt = lines[idx + 1] if not _looks_like_label(nxt): value = normalize_text(nxt) if value: result[key] = value return resultpython structured: Dict[str, object] = { "source": { "submission_docx": str(submission_path), "template_docx": str(template_path), "review_rule_docx": str(rule_path), }, "template_items": sorted(set([x for x in tpl_lines if len(x) <= 40])), "basic_info": _extract_basic_info(sub_lines, sub_tables), "data_resources": [r.__dict__ for r in _extract_resources(sub_lines, sub_tables)], "rule_points": rule_lines, }python structured_path.write_text( json.dumps(structured, ensure_ascii=False, indent=2), encoding="utf-8", )Technical Analysis
The parser explicitly recognizes a document field labeled as a password and stores its value under
database_password_note. The extracted value is retained unchanged inbasic_infoand serialized into `structu ...[truncated 1358 chars]- Remediation
View remediation
Remediation Suggestions
- Remove password-related aliases from the extraction schema unless the field's presence must be validated.
- If presence validation is required, record only a Boolean indicator such as
password_provided: true; never retain the value. - Apply centralized redaction before serialization so fields matching password, secret, token, key, or credential patterns become
[REDACTED]. - Exclude sensitive fields from generated reports, logs, exceptions, and debugging output.
- Create output files with owner-only permissions, such as mode
0600, and create the output directory with mode0700. - Document that users must not place live credentials in review materials and should use a secure secret-delivery channel for operational handoff.
- Review and securely delete previously generated artifacts that may contain plaintext credentials.