T09 · Insecure Skill Coding Practices
Error
- Location
scripts/disposal.py:477- Finding
Plaintext encryption password transmitted to unrestricted webhook destinations
- Content
View full analysis
bool: if not self.feishu_webhook: return False message = { "msg_type": "text", "content": { "text": f"**{title}**\n{content}" + (f"\n\n密码: `{password}`" if password else "") } } try: import requests response = requests.post(self.feishu_webhook, json=message, timeout=10) return response.status_code == 200 except Exception: return False def send_wecom(self, title: str, content: str, password: str = None) -> bool: if not self.wecom_webhook: return False message = { "msgtype": "text", "text": { "content": f"{title}\n{content}" + (f"\n\n密码: {password}" if password else "") } } try: import requests response = requests.post(self.wecom_webhook, json=message, timeout=10) return response.status_code == 200 except Exception: return False ``` The password is propagated to the notification service after encryption: ```python if result['status'] == 'success' and kwargs.get('notify_channels'): self.notification.send_notification( action=action, file_count=1, password=result.get('password'), notify_channels=kwargs.get('notify_channels') ) ``` Webhook destinations are accepted through configuration or command-line arguments: ```python parser.add_argument('--feishu-webhook', type=str, help='飞书Webhook地址') parser.add_argument('--wecom-webhook', type=str, help='企业微信Webhook地址') config.setdefault('feishu_webhook', args.feishu_webhook) config.setdefault('wecom_webhook', args.wecom_webhook) ``` ### Techn ...[truncated 2159 chars]- Remediation
View remediation