T09 · Insecure Skill Coding Practices
Error
- Location
assets/index.html:254- Finding
Persistent Plaintext Storage of API Credentials
- Content
View full analysis
localStorage.setItem(API_BASE_STORAGE_KEY, apiBaseInput.value.trim())); apiKeyInput.addEventListener('change', () => localStorage.setItem(API_KEY_STORAGE_KEY, apiKeyInput.value.trim())); ``` ### Technical Analysis The application persists the user's bearer API key in `localStorage`. Local storage provides no confidentiality protection and is readable by any JavaScript executing under the same origin. The credential also remains available after the page is closed and across browser sessions. The password input type only masks the displayed characters; it does not protect the value after storage. This weakness becomes particularly serious in combination with the DOM injection vulnerabilities elsewhere in the page, because injected JavaScript can directly retrieve the key using: ```javascript localStorage.getItem('book_redesign_api_key') ``` The credential may also be exposed to compromised same-origin pages, malicious browser extensions with page access, or anyone with access to the browser profile. ### Attack Path 1. A user enters a valid API key in the API settings form. 2. The input's `change` handler writes the plaintext key to `localStorage`. 3. Malicious JavaScript gains execution under the page's origin, such as through one of the API-response DOM injection vulnerabilities. 4. The malicious code reads `book_redesign_api_ke ...[truncated 556 chars]- Remediation
View remediation