T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/senseaudio_platform_token.py:78- Finding
Implicit Chrome credential extraction and cookie-authenticated workspace operations
- Content
View full analysis
Tuple[str, str]: script = """ (() => { const collect = storage => { const items = []; for (let i = 0; i < storage.length; i += 1) { const key = storage.key(i); items.push({ key, raw: storage.getItem(key) || '', storage: storage === window.localStorage ? 'localStorage' : 'sessionStorage' }); } return items; }; return JSON.stringify({ href: window.location.href, localStorage: collect(window.localStorage), sessionStorage: collect(window.sessionStorage), }); })() """ raw = apple_script(script) if not raw: return "", "" payload = json.loads(raw) for storage_name in ("localStorage", "sessionStorage"): for item in payload.get(storage_name, []): if not isinstance(item, dict): continue key = str(item.get("key", "")) raw_value = str(item.get("raw", "")) token = parse_zustand_payload(raw_value, key) if token: return token, f"{storage_name}:{key}" return "", "" ``` `scripts/senseaudio_platform_token.py:112-131`: ```python def resolve_platform_token( explicit_token: str = "", *, token_env: str = DEFAULT_PLATFORM_TOKEN_ENV, allow_chrome: bool = True, ) -> Tuple[str, str]: token = explicit_token.strip() if token: return token, "explicit" token = os.getenv(token_env, "").strip() if token: return token, f"env:{token_env}" if allow_chrome: try: token, key = ...[truncated 7041 chars]- Remediation
View remediation