T09 · Insecure Skill Coding Practices
Error
- Location
scripts/redact_openclaw_config.py:37- Finding
Sensitive-key values shorter than 24 characters bypass redaction
- Content
View full analysis
str: s = s or "" if len(s) <= 8: return "***" return f"{s[:4]}…{s[-4:]}" def looks_secret(s: str) -> bool: if len(s) < 24: return False if s.startswith(("http://", "https://", "/", "./", "../", "~/")): return False return bool(JWT_LIKE_RE.match(s) or HEXISH_RE.match(s) or ALNUMISH_RE.match(s)) def redact_string(s: str) -> str: if looks_secret(s): return mask(s) return URL_QS_SECRET_RE.sub(lambda m: m.group("prefix") + mask(m.group("val")), s) def redact_obj(obj: Any) -> Any: if isinstance(obj, dict): out: dict[str, Any] = {} for key, value in obj.items(): skey = str(key) if SENSITIVE_KEY_RE.search(skey): if isinstance(value, str): out[skey] = redact_string(value) else: out[skey] = "***" else: out[skey] = redact_obj(value) return out ``` ### Technical Analysis When a key matches `SENSITIVE_KEY_RE`, its string value is passed to `redact_string()` rather than being unconditionally replaced. `redact_string()` only masks a standalone value if `looks_secret()` recognizes it as secret-like. The first condition in `looks_secret()` rejects every value shorter than 24 characters. Consequently, short passwords, API keys, session keys, cookies, and tokens remain unchanged unless they happen to appear as a recognized URL query parameter. This violates the script's documented security purpose: users are instructed to run it before sharing a configuration file and may reasonably treat its output as safe. The issue affects structured JSON and JSON5 processing. Retaining four-character prefixes and suffixes for longer credentials ...[truncated 1443 chars]- Remediation
View remediation