T09 · Insecure Skill Coding Practices
Warning
- Location
logistics.py:87- Finding
Shipment Data Is Persisted in an Unprotected Plaintext SQLite Database
- Content
View full analysis
sqlite3.Connection: """Initialize the database.""" conn = sqlite3.connect(str(DB_FILE)) cursor = conn.cursor() cursor.execute(''' CREATE TABLE IF NOT EXISTS history ( id INTEGER PRIMARY KEY AUTOINCREMENT, tracking_number TEXT NOT NULL, carrier_code TEXT, carrier_name TEXT, status TEXT, result TEXT, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ) ''') cursor.execute(''' CREATE TABLE IF NOT EXISTS subscriptions ( id INTEGER PRIMARY KEY AUTOINCREMENT, tracking_number TEXT NOT NULL UNIQUE, carrier_code TEXT, last_status TEXT, notify_enabled BOOLEAN DEFAULT 1, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ) ''') conn.commit() return conn ``` ```python def _save_history(self, result: TrackingResult): """Save query history.""" cursor = self.db.cursor() cursor.execute(''' INSERT INTO history (tracking_number, carrier_code, carrier_name, status, result) VALUES (?, ?, ?, ?, ?) ''', ( result.tracking_number, result.carrier_code, result.carrier_name, result.status, json.dumps( result.__dict__, default=lambda x: x.__dict__ if hasattr(x, '__dict__') else str(x) ) )) self.db.commit() ``` ### Technical Analysis Tracking numbers, courier details, shipment status, and serialized tracking results are written directly to `logistics.db` without encryptio ...[truncated 1576 chars]- Remediation
View remediation