T09 · Insecure Skill Coding Practices
Error
- Location
src/tg_cli/config.py:83- Finding
Sensitive Telegram session and message database files lack enforced restrictive permissions
- Content
View full analysis
str: """Return session file path inside data/ directory.""" data_dir = get_data_dir() name = get_session_name() return str(data_dir / name) def get_data_dir() -> Path: """Return data directory, create if not exists.""" raw = os.environ.get("DATA_DIR", "") if raw: d = _resolve_env_path(raw) else: d = _default_data_home() / APP_NAME d.mkdir(parents=True, exist_ok=True) return d def get_db_path() -> Path: raw = os.environ.get("DB_PATH", "") if raw: p = _resolve_env_path(raw) else: p = get_data_dir() / "messages.db" p.parent.mkdir(parents=True, exist_ok=True) return p ``` ```python @asynccontextmanager async def connect() -> AsyncGenerator[TelegramClient, None]: """Async context manager for Telegram client — single connection, reuse within scope.""" try: api_id = get_api_id() api_hash = get_api_hash() except MissingTelegramCredentialsError as exc: raise click.ClickException(str(exc)) from exc c = TelegramClient(get_session_path(), api_id, api_hash) await c.start() try: yield c finally: await c.disconnect() ``` ```python class MessageDB: """SQLite message store with context manager support.""" def __init__(self, db_path: Path | str | None = None): if db_path is None: self.db_path = get_db_path() else: self.db_path = Path(db_path) self.db_path.parent.mkdir(parents=True, exist_ok=True) self.conn = sqlite3.connect(str(self.db_path)) self.conn.row_factory = sqlite3.Row self.conn.execute("PRAGMA journal_mode=WAL") self.conn.execute ...[truncated 2352 chars]- Remediation
View remediation