T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/batch_update.py:61- Finding
Sensitive Feishu Resource Identifiers Exposed in Logs
- Content
View full analysis
Vulnerability Details
File Location:
scripts/batch_update.py:61, 73, 120; related instances also occur inscripts/bitable_to_doc.py:23andscripts/wiki_backup.py:28, 87, 313
Vulnerability Type: Sensitive identifier exposure through logging
Risk Level: MediumComplete Code Snippet
python def get_documents_in_folder(folder_token): """ Get list of document tokens in a folder. This is a placeholder - in practice, you'd use feishu_drive list action. """ # In real implementation, use: # exec_result = exec('tool call', {'tool': 'feishu_drive', 'action': 'list', 'folder_token': folder_token}) # Parse document tokens from response print(f"[INFO] Would fetch documents in folder: {folder_token}") # Return sample data for demonstration return ["doc_token_1", "doc_token_2"] def update_document(doc_token, content): """ Update a Feishu document with new content. This is a placeholder - in practice, you'd use feishu_doc write action. """ # In real implementation, use: # exec_result = exec('tool call', {'tool': 'feishu_doc', 'action': 'write', 'doc_token': doc_token, 'content': content}) print(f"[INFO] Would update document {doc_token}") print(f"Content preview: {content[:100]}...") return TrueAdditional affected logging statements include:
python print(f"[INFO] Querying Bitable {table_id} in app {app_token}") print(f"[INFO] Fetching wiki structure for space {space_id}") print(f"[INFO] Reading wiki page {obj_token}") print(f"{prefix}- {node['title']} ({node['node_token']})")Technical Analysis
User-supplied Feishu app, folder, document, wiki, space, and object identifiers are written directly to standard output without masking. Standard output is commonly captured by CI/CD systems, schedulers, container platforms, monitoring agents, and support bundles.
This behavior ...[truncated 1869 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove complete resource tokens from normal operational logs.
- Introduce a centralized masking function that retains only a short suffix, for example:
python def mask_token(value): if not value: return "<unset>" return f"***{value[-4:]}" if len(value) > 4 else "***" - Apply masking consistently to app, table, folder, document, wiki, object, node, and space identifiers.
- Remove content previews by default. Permit them only through an explicit debug option and display a warning that sensitive content may be logged.
- Load and enforce the documented
security.mask_tokens_in_logsconfiguration rather than leaving it as an unused setting. - Configure log access controls, retention limits, and automated redaction in CI and centralized logging systems.
- Add tests asserting that known token patterns and template secrets never appear in emitted logs.