T09 · Insecure Skill Coding Practices
Error
- Location
scripts/xyfcli/config.py:52- Finding
Bearer Token Stored in Plaintext and Exposed Through Configuration Output
- Content
View full analysis
None: """保存配置文件""" # 确保配置目录存在 CONFIG_DIR.mkdir(parents=True, exist_ok=True) with open(CONFIG_FILE, "w", encoding="utf-8") as f: json.dump(config, f, indent=2, ensure_ascii=False) ``` ```python def show_config( json_output: bool = typer.Option(False, "-j", "--json", help="输出JSON格式") ): """显示当前配置""" config = load_config() if json_output: format_output(config, json_output) else: typer.echo("当前配置:") typer.echo(f" API 基础 URL: {config.get('base_url', DEFAULT_CONFIG['base_url'])}") typer.echo(f" Authorization Token: {config.get('authorization_token', DEFAULT_CONFIG['authorization_token'])[:20]}...") ``` ```python if json_output: result = { "success": True, "message": "配置文件已初始化", "config": config } format_output(result, json_output) else: typer.echo("配置文件已初始化") typer.echo(f" API 基础 URL: {base_url}") typer.echo(f" Authorization Token: {token[:20]}..." if len(token) > 20 else f" Authorization Token: {token}") ``` ### Technical Analysis The CLI stores its bearer authorization token in `~/.xyfcli/config.json` as unencrypted JSON. The configuration directory and file are created without explicitly enforcing owner-only permissions such as `0700` for the directory and `0600` for the file. Their effective permissions therefore depend on the process umask and surrounding environment. In addition, `xyfcli config show --json` serializes the entire configuration object, including the complete `authorization_token`. The JSON form of `config init` also includes the complete configuration. In normal output, ...[truncated 1505 chars]- Remediation
View remediation