T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/risk_diff.py:319
- Finding
- Weak and Intentionally Bypassable Premium License Validation## Vulnerability Details **File Location**: `scripts/risk_diff.py`, lines 319–343 **Vulnerability Type**: Weak authorization and license verification **Risk Level**: Medium ```python # Replace with your Gumroad/LemonSqueezy verify endpoint in production. # For now, accept any key listed here OR any key whose SHA-256 prefix matches. _VALID_LICENSE_PREFIXES = { # SHA-256(b"DEMO-FOR-OPERATOR")[:8] — operator bypass. "9b2d6fb1", # SHA-256(b"EDGARRISK-NOVELTY-2026-A4G7")[:8] — production v1 key (Gumroad). "bc4c1307", } def license_active() -> bool: key = "" if "EDGAR_RISK_LICENSE" in os.environ: key = os.environ["EDGAR_RISK_LICENSE"].strip() elif LICENSE_PATH.exists(): key = LICENSE_PATH.read_text(encoding="utf-8").strip() if not key: return False digest = hashlib.sha256(key.encode()).hexdigest()[:8] return digest in _VALID_LICENSE_PREFIXES def require_license(feature: str) -> None: if license_active(): return ``` ### Technical Analysis License validation compares only the first eight hexadecimal characters of a SHA-256 digest. This reduces the effective verification space to 32 bits rather than relying on the full cryptographic digest or a digital signature. Because both accepted prefixes are embedded in publicly readable source code, an attacker can generate arbitrary candidate strings offline until one produces a matching prefix. The code also explicitly includes an operator-bypass prefix, creating an alternate entitlement path in the distributed application. Although the corresponding plaintext key is shown only in a comment as the hash input description, the presence of a bypass mechanism further undermines the authorization boundary. This issue does not enable operating-system privilege escalation, code execution, credential access, or data exfiltration. It is an application-level authorization weakness affecting the premium feature gate. ### Attack Path 1. Inspect `scripts/ ...[truncated 949 chars]
- Remediation
- ## Remediation Suggestions 1. Replace truncated-hash comparison with cryptographically signed offline licenses. Sign entitlement data with a vendor-controlled private key and verify the complete signature using an embedded public key. 2. If online verification is acceptable, validate licenses through an authenticated HTTPS vendor endpoint and verify the response securely. 3. Remove the operator-bypass value and all alternate production authorization paths from distributed code. 4. Do not treat an unsalted hash or hash prefix as proof that a license was issued by the vendor. 5. Bind licenses to explicit entitlement metadata, such as product, enabled feature, expiration date, and license identifier, and include all metadata in the signed payload. 6. Fail closed on malformed licenses, invalid signatures, expired entitlements, and verification errors. 7. Add automated tests confirming that arbitrary values and prefix collisions cannot activate premium functionality.