T09 · Insecure Skill Coding Practices
Error
- Location
- src/tg_cli/config.py:83
- Finding
- Sensitive Telegram session and message database files lack enforced restrictive permissions<![CDATA[ ## Vulnerability Details **File Locations**: - `src/tg_cli/config.py:83-108` - `src/tg_cli/client.py:37-50` - `src/tg_cli/db.py:55-66` **Vulnerability Type**: Insecure permissions for sensitive local data **Risk Level**: High ### Vulnerable Code ```python def get_session_path() -> str: """Return session file path inside data/ directory.""" data_dir = get_data_dir() name = get_session_name() return str(data_dir / name) def get_data_dir() -> Path: """Return data directory, create if not exists.""" raw = os.environ.get("DATA_DIR", "") if raw: d = _resolve_env_path(raw) else: d = _default_data_home() / APP_NAME d.mkdir(parents=True, exist_ok=True) return d def get_db_path() -> Path: raw = os.environ.get("DB_PATH", "") if raw: p = _resolve_env_path(raw) else: p = get_data_dir() / "messages.db" p.parent.mkdir(parents=True, exist_ok=True) return p ``` ```python @asynccontextmanager async def connect() -> AsyncGenerator[TelegramClient, None]: """Async context manager for Telegram client — single connection, reuse within scope.""" try: api_id = get_api_id() api_hash = get_api_hash() except MissingTelegramCredentialsError as exc: raise click.ClickException(str(exc)) from exc c = TelegramClient(get_session_path(), api_id, api_hash) await c.start() try: yield c finally: await c.disconnect() ``` ```python class MessageDB: """SQLite message store with context manager support.""" def __init__(self, db_path: Path | str | None = None): if db_path is None: self.db_path = get_db_path() else: self.db_path = Path(db_path) self.db_path.parent.mkdir(parents=True, exist_ok=True) self.conn = sqlite3.connect(str(self.db_path)) self.conn.row_factory = sqlite3.Row self.conn.execute("PRAGMA journal_mode=WAL") self.conn.execute ...[truncated 2352 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create the application data directory with owner-only permissions: ```python d.mkdir(parents=True, exist_ok=True, mode=0o700) d.chmod(0o700) ``` 2. Verify that configured data paths are owned by the current user and are not group-writable or world-writable. Refuse to use unsafe locations unless the user explicitly overrides a warning. 3. After creating or opening sensitive files, enforce mode `0600` on: - The Telethon session file. - `messages.db`. - SQLite `messages.db-wal` and `messages.db-shm` files when present. 4. Temporarily use a restrictive umask such as `0o077` while creating sensitive application files. 5. Detect and reject symbolic links for session and database targets where practical, reducing the risk of writing to or opening an unintended file. 6. Validate `TG_SESSION_NAME` as a simple filename rather than allowing path separators or traversal components. 7. Document that the database contains plaintext message history and that the Telethon session must be protected like an authentication credential. 8. Add automated tests that run under a permissive umask and verify that all created directories and sensitive files remain accessible only to their owner. ]]>