T09 · Insecure Skill Coding Practices
Note
- Location
scripts/chat.py:24- Finding
Insecure Plaintext Session-State Storage
- Content
View full analysis
Dict[str, Any]: """Load session state""" if SESSION_STATE_FILE.exists(): try: with open(SESSION_STATE_FILE, "r", encoding="utf-8") as f: return json.load(f) except Exception: pass return {} def save_session_state(state: Dict[str, Any]) -> None: """Save session state""" SESSION_STATE_FILE.parent.mkdir(parents=True, exist_ok=True) with open(SESSION_STATE_FILE, "w", encoding="utf-8") as f: json.dump(state, f, ensure_ascii=False, indent=2) ``` The state is subsequently loaded and saved as follows: ```python # Process conversation ID conversation_id = args.conversation_id if not conversation_id and not args.new_session: # Read conversation ID from state file state = load_session_state() conversation_id = state.get("conversation_id") if conversation_id: print(f"[Using saved conversation: {conversation_id}]", file=sys.stderr) # Call API result = chat( query=args.query or "", app_id=args.app_id, stream=args.stream, conversation_id=conversation_id, file_ids=file_ids, tools=tools, tool_choice=tool_choice, tool_outputs=tool_outputs, action=action, end_user_id=args.end_user_id, metadata_filter=metadata_filter, custom_metadata=custom_metadata, ) # Save conversation ID if "conversation_id" in result: save_session_state({"conversation_id": result["conversation_id"]}) ``` ### Technical Analysis The returned conversation identifier is stored in plaintext at the predictable path `state/session.json`. The code creates the directory and file wi ...[truncated 2883 chars]- Remediation
View remediation