T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tsend/config.py:25- Finding
Telegram bot token stored in plaintext without enforced restrictive permissions
- Content
View full analysis
None: """Save configuration to file""" self.CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(self.CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(self._data, f, indent=2, ensure_ascii=False) ``` The CLI accepts and persists the token as follows: ```python @config_app.command() def set( token: Optional[str] = typer.Option(None, "--token", "-t", help="Set bot token"), chat_id: Optional[str] = typer.Option(None, "--chat-id", help="Set chat ID"), profile: Optional[str] = typer.Option(None, "--profile", "-p", help="Profile to update"), ): """Set configuration values""" cfg = get_config(profile) if profile: typer.echo(f"🔧 Profile: {profile}") elif cfg.active_profile_name: typer.echo(f"🔧 Profile: {cfg.active_profile_name}") else: typer.echo("🔧 Profile: (default)") # Set values if token: cfg.set("token", token) typer.echo("✅ Token updated") if chat_id: cfg.set("chat_id", chat_id) typer.echo("✅ Chat ID updated") # Save if any changes if token or chat_id: cfg.save() ``` ### Technical Analysis The configuration data includes the Telegram bot token and is serialized directly into `~/.tsend/config.json` as plaintext. Neither the configuration directory nor the file is created with an explicit restrictive mode. Their effective permissions therefore depend on the process umask and existing filesystem permissions. On a multi-user system with a permissive umask or an insecure pre-existing `~/.tsend` directory, other local users or processes may be able to read the bot token. The implementation also r ...[truncated 1722 chars]- Remediation
View remediation