T05 · Unauthorized Access and Privilege Escalation
Error
- Location
project/src/session.ts:23- Finding
Application and Sensitive Capability Requests Are Silently Auto-Approved
- Content
View full analysis
app.resolved && !app.alreadyGranted) .map(app => ({ bundleId: app.resolved!.bundleId, displayName: app.resolved!.displayName, grantedAt: Date.now(), tier: app.proposedTier, })) const denied = req.apps .filter(app => !app.resolved) .map(app => ({ bundleId: app.requestedName, reason: 'not_installed' as const, })) return { granted, denied, flags: { ...DEFAULT_GRANT_FLAGS, ...req.requestedFlags, }, } } ``` The automatically approving function is installed directly as the permission handler: ```ts onPermissionRequest: async req => autoApprovePermission(req), ``` The model-facing tool schema describes `request_access` as requesting user permission and states that clipboard and system-key permissions are presented separately. The standalone session does not present such a confirmation mechanism. Instead, it approves every resolved, eligible application and copies all requested capability flags into the active grants. Built-in application tiers and policy-denied application categories continue to restrict some operations. However, these policy controls are not a substitute for user authorization and do not prevent silent approval of otherwise eligible applications. ### Technical Analysis The permission boundary is controlled by `onPermissionRequest`. A secure implementation should ask the user to approve the requested applications and sensitive flags or fail closed if no trusted approval channel exists. Here, application grants are generated solely from whether the application can be resolved as installe ...[truncated 1791 chars]- Remediation
View remediation