T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/x5_client.py:430- Finding
Application Secrets Exposed Through JSON List Output
- Content
View full analysis
str: """Format the result for display.""" if json_mode: return json.dumps(result, indent=2, ensure_ascii=False) ``` ### Technical Analysis Each parsed request object contains the `appkey` directive from the `.x5` file: ```python elif key_lower == 'appkey': result['appkey'] = value ``` When `--list --json` is used, the program places the complete `requests` collection into the result and serializes it without filtering sensitive fields. Consequently, application secret keys are written to standard output alongside non-sensitive request metadata. Other execution modes use `_safe_request()` to construct a restricted output object, but list mode bypasses that protection. This behavior is unnecessary for listing requests because the human-readable list only requires fields such as name, method, URL, and optional headers. The documentation recommends using `--json` for programmatic consumption, making accidental disclosure to agent context, CI logs, terminal captures, or automation systems reasonably likely. ### Attack Path 1. An attacker supplies or modifies an `.x5` file containing an application credential in its `@appkey` directive. 2. A user or agent invokes the documented list operation with JSON output: ```bash python3 scripts/x5_client.py --file request.x5 --list --json ``` 3. The parser stores the secret in each request dictionary. 4. List mode passes the complete dictionaries to `format_output()`. 5. `json.dumps()` writes the application key to standard output. 6. T ...[truncated 648 chars]- Remediation
View remediation
dict: return { 'name': req.get('name'), 'method': req.get('method'), 'url': req.get('url'), 'headers': req.get('headers', {}), } if args.list: result = { 'mode': 'list', 'requests': [_safe_list_request(req) for req in requests], } print(format_output(result, args.json)) return ``` - Consider redacting other potentially sensitive values, particularly authorization headers, cookies, and API tokens in custom headers. - Apply centralized output sanitization so new output modes cannot accidentally bypass secret filtering. - Add automated tests confirming that `appkey`, authorization headers, and representative secret values never appear in either JSON or human-readable list output. ]]>