T09 · Insecure Skill Coding Practices
Error
- Location
- sanitize.py:34
- Finding
- Incomplete denylist sanitizer can transmit sensitive payload data## Vulnerability Details **File Location**: `sanitize.py:34-86` **Vulnerability Type**: Sensitive data exposure caused by incomplete input sanitization **Risk Level**: High The documentation instructs users to sanitize payloads before transmitting them to the NotaryOS API and states that the helper automatically handles message bodies, file contents, health information, credentials, and financial information. The implementation only recognizes a limited set of sensitive field names and substrings. **Vulnerable code:** ```python # Field names that are stripped (case-insensitive exact match). _BLOCKED_FIELDS: Set[str] = { "passwd", "bearer", "credentials", "private_key", "signing_key", "cvv", "cvc", "expiry", "account_number", "routing_number", "iban", "swift", "bank_account", "ssn", "social_security", "national_id", "passport_number", "drivers_license", "dob", "date_of_birth", } # Substrings in field names that indicate sensitivity. _BLOCKED_SUBSTRINGS = ( "password", "secret", "token", "credential", "api_key", "apikey", ) def sanitize_payload( payload: Dict[str, Any], extra_fields: Optional[Set[str]] = None, redact: bool = False, ) -> Dict[str, Any]: """ Remove sensitive fields from a payload dict. Args: payload: Raw dict to sanitize. extra_fields: Additional field names to strip. redact: If True, replace values with "[REDACTED]" instead of removing. Returns: New dict with sensitive fields removed. Original is not modified. """ blocked = _BLOCKED_FIELDS | (extra_fields or set()) result: Dict[str, Any] = {} for key, value in payload.items(): lower = key.lower() if lower in blocked or any(p in lower for p in _BLOCKED_SUBSTRINGS): if redact: result[key] = "[REDACTED]" continue if isinstanc ...[truncated 2809 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the denylist-only approach with action-specific allowlists. Only documented, non-sensitive metadata such as public identifiers, counts, timestamps, and approved paths should be retained. 2. Explicitly block all sensitive fields identified in the documentation, including message-body, file-content, health-data, authorization-header, cookie, session, and payment-card variants. 3. Normalize `extra_fields` to lowercase before comparison so custom filtering remains case-insensitive. 4. Recursively inspect all supported containers, including nested lists and tuples. Reject unsupported object types rather than copying them unchanged. 5. Consider rejecting payloads that contain unapproved keys instead of attempting to infer sensitivity from their names. 6. Add unit tests for `body`, `content`, `file_content`, `authorization`, `cookie`, `card_number`, health-data fields, mixed-case field names, and sensitive scalar list entries. 7. Revise the documentation to describe the filter as best-effort unless comprehensive enforcement is implemented. Require explicit user approval before transmitting payloads that may contain user data.