T09 · Insecure Skill Coding Practices
Error
- Location
scripts/export-config.py:59- Finding
Incomplete Fallback Redaction Can Expose Configuration Secrets
- Content
View full analysis
dict: """ Fallback: read raw config file and apply conservative key-name redaction. Used when the CLI is unavailable. """ SENSITIVE_KEY = re.compile( r"(token|secret|password|apikey|api_key|private_?key|credential|signing|client_secret|access_key)", re.IGNORECASE, ) def redact(obj, key=""): if isinstance(obj, dict): return {k: redact(v, k) for k, v in obj.items()} elif isinstance(obj, list): return [redact(i, key) for i in obj] elif isinstance(obj, str) and SENSITIVE_KEY.search(key): return "[REDACTED]" return obj with open(config_path) as f: return redact(json.load(f)) ``` ```python # Try CLI first (authoritative redaction) data = export_via_cli() if not data: # Fallback to raw file if config_path and config_path.exists(): print(" ! openclaw CLI unavailable, falling back to file-based redaction") data = export_via_file(config_path) else: print(" - config (openclaw CLI unavailable and no fallback config path, skipping)") sys.exit(0) ``` ```bash CONFIG_PATH="$(dirname "$WORKSPACE")/openclaw.json" python3 "$SCRIPT_DIR/export-config.py" "$BACKUP_DIR/config-redacted.json" "$CONFIG_PATH" ``` ```bash git push origin "$(git rev-parse --abbrev-ref HEAD)" ``` ### Technical Analysis The preferred export mechanism delegates redaction to the OpenClaw CLI. If that mechanism returns no data, however, the script reads the raw `openclaw.json` file and redacts string values solely according to their immediate key names. The regular expression covers several common nam ...[truncated 1955 chars]- Remediation
View remediation