T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/lib/env.py:35- Finding
Automatic Reuse of Ambient Codex and Browser Session Credentials
- Content
View full analysis
Dict[str, Any]: """Load Codex auth JSON.""" if not path.exists(): return {} try: with open(path, "r") as f: return json.load(f) except Exception: return {} def get_codex_access_token() -> tuple[Optional[str], str]: """Get Codex access token from auth.json. Returns: (token, status) where status is 'ok', 'missing', or 'expired' """ auth = load_codex_auth() token = None if isinstance(auth, dict): tokens = auth.get("tokens") or {} if isinstance(tokens, dict): token = tokens.get("access_token") if not token: token = auth.get("access_token") if not token: return None, AUTH_STATUS_MISSING if _token_expired(token): return None, AUTH_STATUS_EXPIRED return token, AUTH_STATUS_OK def get_openai_auth(file_env: Dict[str, str]) -> OpenAIAuth: """Resolve OpenAI auth from API key or Codex login.""" api_key = os.environ.get('OPENAI_API_KEY') or file_env.get('OPENAI_API_KEY') if api_key: return OpenAIAuth( token=api_key, source=AUTH_SOURCE_API_KEY, status=AUTH_STATUS_OK, account_id=None, codex_auth_file=str(CODEX_AUTH_FILE), ) codex_token, codex_status = get_codex_access_token() if codex_token: account_id = extract_chatgpt_account_id(codex_token) if account_id: return OpenAIAuth( token=codex_token, ...[truncated 4652 chars]- Remediation
View remediation