T09 · Insecure Skill Coding Practices
- Location
scripts/generate_injury_claim_docs.py:275- Finding
Unprotected Handling and Storage of Sensitive Personal and Medical Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_injury_claim_docs.py:275-279,scripts/generate_injury_claim_docs.py:541, andscripts/generate_injury_claim_docs.py:581-594
Vulnerability Type: Plaintext sensitive-data exposure through command-line arguments and files with default permissions
Risk Level: MediumComplete Code Snippet
python 身份证号：{case.get("applicant_id", "（待填）")} 住址：{case.get("applicant_address", "（待填）")} 电话：{case.get("applicant_phone", "（待填）")}python parser.add_argument("--applicant-id", help="身份证号")python # Ensure that the output directory exists os.makedirs(args.output_dir, exist_ok=True) # Generate documents app_content = generate_recognition_application(case) comp_content = generate_compensation_table(case) doc_content = generate_document_checklist(case) # Construct output paths app_path = os.path.join(args.output_dir, "工伤认定申请书.md") comp_path = os.path.join(args.output_dir, "工伤待遇计算表.md") doc_path = os.path.join(args.output_dir, "索赔材料清单.md") with open(app_path, "w", encoding="utf-8") as f: f.write(app_content)Technical Analysis
The generator processes government identification numbers, residential addresses, telephone numbers, medical diagnoses, employment details, and injury-claim information. It permits at least the applicant's government ID to be supplied as a command-line argument and embeds the sensitive values directly in plaintext Markdown documents.
Sensitive command-line arguments may be exposed through shell history, process inspection facilities, terminal logs, or command auditing systems. The generated output directory is created without an explicit restrictive mode, and files are opened without explicitly enforcing owner-only permissions. Their effective permissions therefore depend on the process umask and the permissions of an existing destination directory.
On a shared system or under a permissiv ...[truncated 1881 chars]
- Remediation
View remediation
Remediation Suggestions
- Avoid accepting government IDs and other sensitive values through command-line arguments. Prefer a protected JSON file, standard input, or an interactive prompt that does not retain values in shell history.
- Create new output directories with owner-only permissions such as
0700, and verify that existing directories are not accessible to unintended users. - Create output files with mode
0600, using secure low-level creation flags where appropriate, rather than relying only on the process umask. - Validate destination paths before writing. Refuse unsafe shared destinations and symbolic-link output targets where an untrusted local user could redirect or observe output.
- Warn users not to place generated documents in public, temporary, shared, source-controlled, or automatically synchronized directories.
- Add a redacted-output option that masks government IDs, telephone numbers, addresses, and medical details unless full values are explicitly required.
- Document retention and secure-deletion expectations for configuration files and generated documents.
- Add automated tests that verify owner-only permissions for newly created directories and files.