T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/liepin-v4.mjs:398- Finding
Authentication Cookies Are Imported with Security Attributes Disabled
- Content
View full analysis
({ name: c.name, value: c.value, domain: '.liepin.com', path: '/', httpOnly: false, secure: false, sameSite: 'Lax' }))); } ``` ### Technical Analysis The Skill reads authentication cookies from `liepin-config.json`, but it does not preserve their original security attributes. Every imported cookie is explicitly assigned: - `httpOnly: false`, making the cookie accessible to JavaScript running in the page. - `secure: false`, allowing the cookie to be treated as eligible for transmission without the protection normally required by the `Secure` attribute. - `sameSite: 'Lax'`, regardless of the cookie's original cross-site policy. - `domain: '.liepin.com'`, broadening the cookie's availability to Liepin subdomains rather than retaining its original host scope. Authentication cookies are security credentials. Removing `HttpOnly` increases the consequences of a cross-site scripting vulnerability or malicious third-party script on an authenticated Liepin page because page JavaScript may be able to read and disclose the cookie. Broadening the domain also increases the number of origins that may receive or interact with it. The configuration file is trusted without schema validation. Cookie names, values, expiry information, and original security properties are not validated or preserved. ### Attack Path 1. The user places valid Liepin authentication cookies in `liepin-config.json`. 2. The Skill reads the file and imports those cookies into the Playwright browser context. 3. The Skill forcibly changes the cookies to `httpOnly: false` and `secure: false` and assigns them to th ...[truncated 1028 chars]- Remediation
View remediation
{ if (!allowedDomains.has(cookie.domain)) { throw new Error(`Unexpected cookie domain: ${cookie.domain}`); } return { name: cookie.name, value: cookie.value, domain: cookie.domain, path: cookie.path || '/', httpOnly: cookie.httpOnly !== false, secure: cookie.secure !== false, sameSite: cookie.sameSite || 'Lax', ...(Number.isFinite(cookie.expires) ? { expires: cookie.expires } : {}), }; }); await ctx.addCookies(cookies); ``` Additional hardening measures: 1. Validate `liepin-config.json` against a strict schema before importing it. 2. Reject cookies for domains outside an explicit allowlist. 3. Preserve the narrowest original cookie domain and path. 4. Require `Secure` for authentication cookies. 5. Preserve `HttpOnly`; do not make authentication cookies available to page JavaScript. 6. Restrict filesystem permissions on `liepin-config.json` to the current user. 7. Prefer a protected Playwright storage-state file or a dedicated operating-system credential store. 8. Ensure cookie values are never printed to logs or included in error messages. 9. Document session revocation procedures in case the configuration file is exposed. ]]>