T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/batch_update.py:61
- Finding
- Sensitive Feishu Resource Identifiers Exposed in Logs## Vulnerability Details **File Location**: `scripts/batch_update.py:61, 73, 120`; related instances also occur in `scripts/bitable_to_doc.py:23` and `scripts/wiki_backup.py:28, 87, 313` **Vulnerability Type**: Sensitive identifier exposure through logging **Risk Level**: Medium ### Complete Code Snippet ```python def get_documents_in_folder(folder_token): """ Get list of document tokens in a folder. This is a placeholder - in practice, you'd use feishu_drive list action. """ # In real implementation, use: # exec_result = exec('tool call', {'tool': 'feishu_drive', 'action': 'list', 'folder_token': folder_token}) # Parse document tokens from response print(f"[INFO] Would fetch documents in folder: {folder_token}") # Return sample data for demonstration return ["doc_token_1", "doc_token_2"] def update_document(doc_token, content): """ Update a Feishu document with new content. This is a placeholder - in practice, you'd use feishu_doc write action. """ # In real implementation, use: # exec_result = exec('tool call', {'tool': 'feishu_doc', 'action': 'write', 'doc_token': doc_token, 'content': content}) print(f"[INFO] Would update document {doc_token}") print(f"Content preview: {content[:100]}...") return True ``` Additional affected logging statements include: ```python print(f"[INFO] Querying Bitable {table_id} in app {app_token}") print(f"[INFO] Fetching wiki structure for space {space_id}") print(f"[INFO] Reading wiki page {obj_token}") print(f"{prefix}- {node['title']} ({node['node_token']})") ``` ### Technical Analysis User-supplied Feishu app, folder, document, wiki, space, and object identifiers are written directly to standard output without masking. Standard output is commonly captured by CI/CD systems, schedulers, container platforms, monitoring agents, and support bundles. This behavior ...[truncated 1869 chars]
- Remediation
- ## Remediation Suggestions 1. Remove complete resource tokens from normal operational logs. 2. Introduce a centralized masking function that retains only a short suffix, for example: ```python def mask_token(value): if not value: return "<unset>" return f"***{value[-4:]}" if len(value) > 4 else "***" ``` 3. Apply masking consistently to app, table, folder, document, wiki, object, node, and space identifiers. 4. Remove content previews by default. Permit them only through an explicit debug option and display a warning that sensitive content may be logged. 5. Load and enforce the documented `security.mask_tokens_in_logs` configuration rather than leaving it as an unused setting. 6. Configure log access controls, retention limits, and automated redaction in CI and centralized logging systems. 7. Add tests asserting that known token patterns and template secrets never appear in emitted logs.