T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_license.py:14- Finding
Hardcoded License Key Enables Authorization Bypass
- Content
View full analysis
str: """计算授权码哈希""" return hashlib.sha256((license_key + salt).encode()).hexdigest() def check_license() -> Tuple[bool, str]: """ 检查授权码 返回: (是否有效, 消息) """ license_key = os.environ.get("SKILL_LICENSE_KEY", "").strip() if not license_key: return False, "未配置授权码，请设置环境变量 SKILL_LICENSE_KEY" # 这里存储已授权的哈希，实际可以从你的服务器动态验证 # 示例：license "demo-license-123" 哈希后是: expected_hash = hash_license("demo-license-123") ``` ### Technical Analysis The accepted license key, `demo-license-123`, and the salt used by the SHA-256 calculation are embedded directly in code distributed to users. Hashing a hardcoded value does not protect it because users can inspect the source and recover the original accepted key without cracking the hash. Authorization is performed entirely on the client. An attacker can therefore supply the disclosed key through `SKILL_LICENSE_KEY`, causing `check_license()` to return a successful result. SHA-256 does not mitigate this issue because the security boundary depends on secrecy of data that is included in the package itself. ### Attack Path 1. Obtain or inspect the distributed skill package. 2. Open `scripts/check_license.py`. 3. Identify the hardcoded accepted key, `demo-license-123`. 4. Configure the environment: ```bash export SKILL_LICENSE_KEY=demo-license-123 ``` 5. Run the skill entry point: ```bash python3 scripts/demo_function.py ``` 6. The supplied value produces the expected hash, the license check succeeds, and the guarded functionality executes without a purchased license. ### Impact Assessment An unauthenticated user with access to t ...[truncated 529 chars]- Remediation
View remediation