T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wxoa.py:57- Finding
Insecure Storage of WeChat Access Token in a Predictable Temporary File
- Content
View full analysis
str: appid = os.environ.get("WX_APPID") or die("未设置 WX_APPID") secret = os.environ.get("WX_SECRET") or die("未设置 WX_SECRET") cache_file = CACHE % appid try: c = json.load(open(cache_file)) if c["expire_at"] > time.time(): return c["token"] except Exception: pass q = urllib.parse.urlencode( {"grant_type": "client_credential", "appid": appid, "secret": secret}) r = http(f"{API}/cgi-bin/token?{q}") if "access_token" not in r: die(f"取 token 失败: {r} (40164=IP不在白名单, 40125=secret错误)") json.dump({"token": r["access_token"], "expire_at": time.time() + 7000}, open(cache_file, "w")) return r["access_token"] ``` ### Technical Analysis The script stores a privileged WeChat access token in the system temporary directory using a filename derived from the AppID: ```text /tmp/wxoa_token_.json ``` An AppID is generally not secret, making the cache path predictable. The file is opened using ordinary `open()` calls without: - Explicitly setting restrictive permissions such as `0600`. - Verifying that the file is owned by the current user. - Rejecting symbolic links. - Using exclusive file creation. - Writing to a secure temporary file followed by atomic replacement. - Placing the cache inside a user-private directory. The permissions assigned during creation depend on the process umask. With a common `022` umask, the resulting file may be readable by other local users. The cached access token authorizes operations against the associated WeChat account until it expires or ...[truncated 2747 chars]- Remediation
View remediation