T09 · Insecure Skill Coding Practices
Error
- Location
src/tg_monitor_kit/session_runtime.py:29- Finding
Reusable Telegram session credentials are copied without restrictive file permissions
- Content
View full analysis
str: """Path prefix for Telethon session (no .session suffix).""" session_dir = self.project_root / "userdata" session_dir.mkdir(parents=True, exist_ok=True) return str(session_dir / self.session_name) ``` ```python # src/tg_monitor_kit/session_runtime.py:29-41 def create_temp_session_client(cfg: Config, purpose: str) -> TempSessionClient: """Create a TelegramClient bound to a temporary copied session file.""" original_base = cfg.session_file_base original_session = f"{original_base}.session" if not os.path.exists(original_session): raise FileNotFoundError( f"未找到会话文件：{original_session}。" "请先执行登录（tg-monitor auth + tg-monitor login）后再运行对应命令。" ) temp_session_base = f"{original_base}_{purpose}_{uuid.uuid4().hex[:8]}" temp_session = f"{temp_session_base}.session" shutil.copy2(original_session, temp_session) ``` ```python # src/tg_monitor_kit/session_runtime.py:52-68 def cleanup_temp_session_files(temp_session_base: str) -> None: """Best-effort cleanup for temporary Telethon sqlite session files.""" candidates = [ f"{temp_session_base}.session", f"{temp_session_base}.session-journal", f"{temp_session_base}.session-wal", f"{temp_session_base}.session-shm", f"{temp_session_base}-journal", f"{temp_session_base}-wal", f"{temp_session_base}-shm", ] for path in candidates: if os.path.exists(path): try: os.remove(path) except OSError: pass ``` ...[truncated 2801 chars]- Remediation
View remediation