T09 · Insecure Skill Coding Practices
Note
- Location
scripts/notion_sync.py:324- Finding
Dry-Run Synchronization Persists Local State
- Content
View full analysis
None: entry = {"timestamp": now_iso(), **entry} path = sync_dir / "_sync_log.jsonl" path.parent.mkdir(parents=True, exist_ok=True) with path.open("a", encoding="utf-8") as handle: handle.write(json.dumps(entry, ensure_ascii=False, sort_keys=True) + "\n") ``` The documented behavior in `references/notion-integration.md:32` is: ```markdown - Default sync commands to dry-run and require `--apply` for writes. ``` ### Technical Analysis The synchronization command represents execution without `--apply` as a dry run and explicitly states that the user must rerun it with `--apply` to write changes. However, `append_sync_log()` is called after both the apply and dry-run branches. It creates the parent directory when necessary and appends an entry to `notion-sync/_sync_log.jsonl`. Several earlier validation and credential-error paths also invoke the same logging function. Therefore, planning and failed validation operations can mutate the filesystem even though no write authorization was provided. This violates expected dry-run semantics and the documented requirement that writes require `--apply`. Although the written data is operational metadata rather than arbitrary attacker-selected file content, the discrepancy can affect automation that treats dry runs as side- ...[truncated 1299 chars]- Remediation
View remediation