T09 · Insecure Skill Coding Practices
Error
- Location
scripts/kbs/publish_kuaishou.py:289- Finding
Automatic Kuaishou Draft Discarding Without User Confirmation
- Content
View full analysis
None: """清除页面缓存的草稿提示（如果有）。""" try: result = page.evaluate(""" () => { const buttons = document.querySelectorAll('button'); for (const btn of buttons) { if (btn.innerText && btn.innerText.includes('放弃')) { btn.click(); return true; } } return false; } """) if result: logger.info("已清除草稿缓存") time.sleep(0.5) except Exception as e: logger.debug("清除草稿缓存时出错：%s", e) ``` The function is called automatically while trying candidate publishing URLs: ```python for url in (*PUBLISH_VIDEO_URL_CANDIDATES, HOME_URL): page.navigate(url) page.wait_for_load() time.sleep(2.0) # 清除草稿缓存 _clear_draft_cache(page) ``` ### Technical Analysis The Kuaishou publishing workflow automatically searches every button on the page and clicks the first button whose visible text contains the substring meaning “Discard.” It does not verify that: - The button belongs to an expected draft-conflict dialog. - The draft was created by the current Skill invocation. - The button has an exact expected label. - The user approved deletion of an existing draft. - The page is in the expected state before the destructive action occurs. The action runs for every candidate URL visited during publishing. Therefore, an existing user draft can be discarded before the requested upload starts. The primary Skill documentation does not clearly disclose that pre-existing drafts may be deleted. This is a destructive state-changing action performed under an authenticated account and exceeds th ...[truncated 1117 chars]- Remediation
View remediation