T09 · Insecure Skill Coding Practices
Warning
- Location
src/pocketsmith/cli.py:24- Finding
Write Protection Is Bypassable Through the Public Python API
- Content
View full analysis
Callable: """Decorator that checks if write operations are allowed before executing.""" @functools.wraps(func) def wrapper(*args, **kwargs): if os.environ.get("POCKETSMITH_ALLOW_WRITES", "").lower() != "true": raise WritesDisabledError() return func(*args, **kwargs) return wrapper ``` However, public API methods perform mutating requests without applying an equivalent check: ```python def delete_transaction(self, transaction_id: int) -> None: """Delete a transaction. Args: transaction_id: The transaction ID. """ self._client.delete(f"/transactions/{transaction_id}") ``` ```python def delete_category(self, category_id: int) -> None: """Delete a category. Note: This deletes all budgets within the category and uncategorizes all transactions assigned to it. Args: category_id: The category ID. """ self._client.delete(f"/categories/{category_id}") ``` ```python def delete_forecast_cache(self, user_id: int) -> None: """Delete and refresh the forecast cache for a user. This recalculates and refreshes the user's cached forecast. Args: user_id: The user ID. """ self._client.delete(f"/users/{user_id}/forecast_cache") ``` The same issue affects the public transaction and category create and update methods. ### Technical Analysis The project advertises write operations as disabled by default unless `POCKETSMITH_ALLOW_WRITES=true`. This restriction is enforced only by decorators attached to CLI handlers. It is not enforced by `Po ...[truncated 1963 chars]- Remediation
View remediation