T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report.py:27- Finding
NewsData API Key Is Stored and Exposed in Plaintext
- Content
View full analysis
dict: if CONFIG_FILE.exists(): cfg = json.loads(CONFIG_FILE.read_text()) merged = {**DEFAULT_CONFIG, **cfg} return merged return DEFAULT_CONFIG.copy() def save_config(cfg: dict): CONFIG_DIR.mkdir(parents=True, exist_ok=True) CONFIG_FILE.write_text(json.dumps(cfg, indent=2)) ``` ```python def fetch_news(country: str = "us", api_key: str = "") -> dict: """News headlines. Uses NewsData.io if API key provided, else a fallback.""" if api_key: data = api_get(f"https://newsdata.io/api/1/latest?apikey={api_key}&country={country}&language=en&size=5") ``` ```python def cmd_config(city=None, crypto=None, news_country=None, news_key=None, show=False): cfg = load_config() if show: print(json.dumps(cfg, indent=2)) return if city: cfg["city"] = city if crypto: cfg["crypto"] = [c.strip().lower() for c in crypto.split(",")] if news_country: cfg["news_country"] = news_country if news_key: cfg["news_api_key"] = news_key save_config(cfg) print("Configuration updated.") print(json.dumps(cfg, indent=2)) ``` ### Technical Analysis The user-supplied NewsData API key is stored directly in the JSON configuration file under `~/.daily-report/config.json`. The code does not explicitly enforce restrictive permissions on either the configuration directory or file, so effective access depends on the user's environment and process umask. The full configuration is also printed by `config --show` and after every configuration update. Because the configuration includes `news_api_key`, the credential can be exposed through terminal history capture, CI/CD logs, scheduled-job ...[truncated 2214 chars]- Remediation
View remediation