T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.py:216- Finding
Sensitive Financial Records Are Created Without Explicitly Restrictive Permissions
- Content
View full analysis
str: """获取数据存储目录，若不存在则自动创建。 优先读取 CFP_DATA_DIR 环境变量，否则使用默认路径。 Returns: 数据目录的绝对路径。 """ data_dir = os.environ.get("CFP_DATA_DIR", DEFAULT_DATA_DIR) os.makedirs(data_dir, exist_ok=True) return data_dir ``` ```python def save_ledger(records: List[Dict[str, Any]], ledger_file: Optional[str] = None) -> str: """保存账本数据。 Args: records: 账本记录列表。 ledger_file: 账本文件路径，默认为数据目录下的 ledger.json。 Returns: 保存的文件路径。 """ if ledger_file is None: ledger_file = os.path.join(get_data_dir(), "ledger.json") os.makedirs(os.path.dirname(ledger_file), exist_ok=True) with open(ledger_file, "w", encoding="utf-8") as f: json.dump(records, f, ensure_ascii=False, indent=2, default=str) return ledger_file ``` ```python def save_items(items: List[Dict[str, Any]], file_path: str) -> None: """保存应收/应付记录。 Args: items: 记录列表。 file_path: 数据文件路径。 """ os.makedirs(os.path.dirname(file_path), exist_ok=True) with open(file_path, "w", encoding="utf-8") as f: json.dump(items, f, ensure_ascii=False, indent=2, default=str) ``` ### Technical Analysis The application stores ledger entries, customer and vendor names, invoice information, amounts, due dates, and receivable/payable status in plaintext JSON files. Neither directory creation nor file creation specifies restrictive permission modes. Consequently, actual permissions depend on the process umask. With a common `022` umask, newly created directories may be `0755` and files may be `0644`, permitting other local accounts to traverse the data directory and read the financial records. Existing ...[truncated 1784 chars]- Remediation
View remediation