T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/adapters/codex.mjs:19- Finding
Broad Collection of Private Codex Conversation History Without Per-Session Scoping
- Content
View full analysis
walk(root, { maxDepth: 8, filter: (file) => file.endsWith(".jsonl") && recent(file, since), diagnostics, label: "Codex session directory", })); ``` ```js for (const file of sessionFiles) { const parsed = parseJsonl(file); malformedLineCount += parsed.malformed; if (!parsed.items.length) continue; const meta = parsed.items.find((item) => item.type === "session_meta")?.payload || {}; const scopedItems = parsed.items.filter((item) => { if (!item.timestamp) return item.type === "session_meta"; const time = new Date(item.timestamp).getTime(); return Number.isFinite(time) && time >= since.getTime() && time <= until.getTime(); }); const times = scopedItems .map((item) => item.timestamp) .filter(Boolean) .map((value) => new Date(value).getTime()) .filter(Number.isFinite); if (!times.length) continue; const token = tokenUsageForRange(parsed.items, since, until); const userMessages = []; for (const item of scopedItems) { if (item.type === "event_msg" && item.payload?.type === "user_message" && item.payload.message) { const clean = cleanUserMessage(item.payload.message); if (clean) userMessages.push(clean); } if (item.type === "response_item" && item.payload?.type === "message" && item.payload.role === "user") { const clean = cleanUserMessage(textOf(item.payload.content)); if (clean) userMessages.push(clean); } } if (!token.total_tokens) sessionsWithoutToken += 1; const start = Math.min(...times); const end = Math.max(...times); sessions.push({ id: meta.id || path.basename( ...[truncated 3856 chars]- Remediation
View remediation