T09 · Insecure Skill Coding Practices
Warning
- Location
src/cdp_typer.py:268- Finding
Sensitive Form Data Is Exposed Through Process Logs
- Content
View full analysis
60 else ''}") ``` Related field verification code also logs values read from page fields: ```python def type_into_field(self, selector, text, clear_first=True): """ Click, focus, verify, then type. The safe way to fill any input field. """ self.click_and_focus(selector) time.sleep(0.3) if clear_first: self.ctrl("a") time.sleep(0.1) self.key("Backspace") time.sleep(0.1) self._send("Input.insertText", {"text": text}) time.sleep(0.2) # Verify value appeared actual = self.js(f""" (function() {{ const el = document.querySelector('{selector}'); if (!el) return null; return el.value !== undefined ? el.value : el.innerText; }})() """) if actual and text[:10] in str(actual): print(f"[cdp] ✅ typed and verified: '{actual[:50]}'") else: print(f"[cdp] ⚠️ typed but value unexpected: '{str(actual)[:50]}'") return actual ``` The multi-field form helper follows the same unsafe pattern: ```python if actual and value in str(actual): print(f"[cdp] field '{selector}' = '{actual}'") results[selector] = actual ``` ### Technical Analysis The generic typing APIs accept arbitrary user-provided text and write that text directly to standard output. Other form-filling paths read values back from the DOM and log those values as well. These helpers are explicitly intended for login forms and other interactive workflows. Consequently, the logged data may include passwords, authentication tokens, email addresses, pri ...[truncated 1800 chars]- Remediation
View remediation