T09 · Insecure Skill Coding Practices
Warning
- Location
tmx_cli.py:291- Finding
Authentication Cookies and Search Tokens Are Stored Without Restrictive File Permissions
- Content
View full analysis
Optional[str]: """Get Algolia search token from Cookidoo API.""" # Check cached token if SEARCH_TOKEN_FILE.exists(): try: with open(SEARCH_TOKEN_FILE, "r") as f: cached = json.load(f) # Check if still valid (with 5 min buffer) if cached.get("validUntil", 0) > dt.datetime.now().timestamp() + 300: return cached.get("apiKey") except: pass # Fetch new token url = f"{COOKIDOO_BASE}/search/api/subscription/token" status, body = fetch(url, cookies) if status != 200: return None try: data = json.loads(body) # Cache token with open(SEARCH_TOKEN_FILE, "w") as f: json.dump(data, f) return data.get("apiKey") ``` ### Technical Analysis The CLI writes reusable Cookidoo session cookies and an Algolia search API token using ordinary `open(..., "w")` operations. It does not explicitly create these files with owne ...[truncated 2474 chars]- Remediation
View remediation
None: flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC fd = os.open(path, flags, 0o600) try: with os.fdopen(fd, "w", encoding="utf-8") as stream: json.dump(data, stream, ensure_ascii=False, indent=2) except Exception: try: os.close(fd) except OSError: pass raise ``` ]]>