T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tms_takecar.py:132- Finding
Authentication token stored without enforced restrictive file permissions
- Content
View full analysis
str: env_file = _resolve_env_file_path(env_file) _ensure_env_parent_dir(env_file) normalized = _normalize_env_config(env_config) with open(env_file, "w", encoding="utf-8") as handle: json.dump(normalized, handle, ensure_ascii=False, indent=2) handle.write("\n") return env_file ``` ```python def persist_token(token: str, config_file: Optional[str] = None) -> dict: env_file = _resolve_env_file_path(config_file) env_config = load_env_config(env_file=env_file) env_config["token"] = token.strip() written_file = save_env_config(env_config, env_file=env_file) return {"saved": True, "config_file": written_file} ``` ### Technical Analysis The authentication token is stored directly in `~/.config/tms-takecar/env.json` as plaintext JSON. The code creates the parent directory and opens the file using ordinary process defaults, but it does not explicitly enforce owner-only permissions on either the directory or the file. Consequently, the effective permissions depend on the user's `umask`, existing directory permissions, and pre-existing file permissions. In a permissive or shared environment, another local user or process may be able to read the token. Rewriting an existing file does not automatically correct unsafe permissions already assigned to it. Plaintext storage is sometimes necessary when an operating-system credential service is unavailable, but explicit access-control hardening is required because this token authorizes ride-hailing API operations. ### Attack Path 1. A user runs `save-token`, causing the token to be stored in `~/.config/tms-takecar/env.json`. 2. The configuration directory or file is creat ...[truncated 951 chars]- Remediation
View remediation