T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/push_wecom_push_notice.py:13
- Finding
- Hardcoded WeCom Webhook Secret Enables Uncontrolled Sensitive Data Transmission<![CDATA[ ## Vulnerability Details **File Location**: `scripts/push_wecom_push_notice.py:13`, `scripts/push_wecom_push_notice.py:42-48`, `scripts/push_wecom_push_notice.py:114-137`, `scripts/push_wecom_push_notice.py:146-168`; automatic invocation at `scripts/git_commit_and_push.sh:32-36` **Vulnerability Type**: Hardcoded secret and unrestricted outbound transmission **Risk Level**: High ### Vulnerable Code ```python DEFAULT_WEBHOOK_URL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=0e41994e-9e62-4713-ad69-fddeaaba8e9a" ``` ```python def read_summary(args) -> str: if args.summary: return args.summary.strip() if args.summary_file: return Path(args.summary_file).read_text(encoding="utf-8").strip() if args.stdin: return sys.stdin.read().strip() return "" ``` ```python def build_content(project_dir: Path, branch: str, commit_ref: str, summary: str) -> str: commit_hash = run_git(project_dir, "rev-parse", "--short", commit_ref) commit_subject = run_git(project_dir, "show", "-s", "--format=%s", commit_ref) timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") summary = summary.strip() if summary.strip() else summarize_from_diff(project_dir, commit_ref) return "\n".join([ f"时间：{timestamp}", f"项目：{project_dir}", f"分支：{branch}", f"提交：{commit_hash} {commit_subject}", "代码变动点：", summary, ]) def post_json(url: str, payload: dict) -> str: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=20) as resp: return resp.read().decode("utf-8", errors="replace") ``` ```python parser.add_argument( "--webhook-url", default=os.environ.get("WECOM_WEBHOOK_URL", DEFAULT_WEBHOOK_URL), help="Override webhook URL" ) ``` ```python response ...[truncated 3024 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed WeCom webhook key. 2. Remove `DEFAULT_WEBHOOK_URL` and all webhook credentials from source control and repository history. 3. Require `WECOM_WEBHOOK_URL` to be supplied through an approved secret manager or protected runtime environment. Fail closed if it is absent. 4. Make outbound notification opt-in and show the destination and payload to the user before transmission. 5. Remove arbitrary `--summary-file` support where possible. Prefer a summary generated from validated Git metadata. 6. If summary files remain supported: - Resolve the path before reading it. - Require it to be a regular file. - Require it to remain within the target repository or a dedicated summary directory. - Reject symlinks, absolute external paths, and traversal outside the permitted directory. - Enforce a strict maximum size. 7. Redact secrets and omit absolute project paths, local usernames, and unnecessary internal filenames. 8. Send only the minimum information necessary, such as a short commit identifier and a user-approved summary. 9. Document the external destination, transmitted fields, retention implications, and failure behavior. 10. Add automated secret scanning and tests verifying that arbitrary local files cannot be included in notifications. ]]>