T09 · Insecure Skill Coding Practices
Error
- Location
src/lib/cookie-manager.ts:19- Finding
Authentication Cookies Are Stored in Plaintext Without Restrictive File Permissions
- Content
View full analysis
{ ensureCookieDir(); const config = getConfig(); const now = new Date(); const expiresAt = new Date(now.getTime() + config.cookieExpiryDays * 24 * 60 * 60 * 1000); const cookieData: CookieData = { cookies, createdAt: now.toISOString(), expiresAt: expiresAt.toISOString(), }; const cookiePath = getCookiePath(this.platform); fs.writeFileSync(cookiePath, JSON.stringify(cookieData, null, 2), 'utf-8'); } ``` ```ts // src/lib/config.ts:16-21 const defaultConfig: Config = { cookieDir: path.join(process.cwd(), 'data', 'cookies'), cookieExpiryDays: 30, headless: false, timeout: 60000, slowMo: 100, }; ``` ```ts // src/lib/config.ts:45-48 export function ensureCookieDir(): string { const config = getConfig(); if (!fs.existsSync(config.cookieDir)) { fs.mkdirSync(config.cookieDir, { recursive: true }); } ``` ### Technical Analysis The application persists complete Playwright session cookies as unencrypted, human-readable JSON. These cookies may contain bearer credentials that allow an authenticated browser session to be reconstructed without knowing the user's password or repeating QR-code authentication. Neither `mkdirSync` nor `writeFileSync` specifies a restrictive permission mode. Effective permissions therefore depend on the process umask. On common Unix-like configurations, the directory may be created as `0755` and the cookie files as `0644`, potentially allowing other local users to discover and read the stored credentials. The cookie directory is also based on `process.cwd()`. If the application is launc ...[truncated 1759 chars]- Remediation
View remediation