T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/session_manager.py:31
- Finding
- Persistent Authenticated Browser Profiles Lack Explicit Filesystem Protection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/session_manager.py`, lines 14 and 31-42; persistent profile use at lines 64-69 and 119-124 **Vulnerability Type**: Insufficient protection of credential-bearing session storage **Risk Level**: Medium ### Vulnerable Code ```python # Session expiration time: seven days SESSION_EXPIRY_SECONDS = 7 * 24 * 3600 ``` ```python if base_dir is None: base_dir = Path(__file__).parent.parent / "sessions" self.base_dir = Path(base_dir) self.base_dir.mkdir(parents=True, exist_ok=True) self.dianping_session_dir = self.base_dir / "dianping" self.xhs_session_dir = self.base_dir / "xiaohongshu" self.dianping_session_dir.mkdir(exist_ok=True) self.xhs_session_dir.mkdir(exist_ok=True) self.state_file = self.base_dir / "session_state.json" self.session_expiry = session_expiry or SESSION_EXPIRY_SECONDS ``` The directories are subsequently used as persistent authenticated browser profiles: ```python browser = await p.chromium.launch_persistent_context( user_data_dir=str(self.dianping_session_dir), headless=headless, viewport={'width': 1280, 'height': 720}, user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' ) ``` ```python browser = await p.chromium.launch_persistent_context( user_data_dir=str(self.xhs_session_dir), headless=headless, viewport={'width': 1280, 'height': 720}, user_agent='Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15' ) ``` ### Technical Analysis Playwright persistent browser profiles can contain authentication cookies, local storage, browser databases, and other reusable account state. The code intentionally stores these profiles under the project directory so that authenticated sessions remain available across runs. The directories are created without an explicit restrictive mode, and the implementation neither verifies nor repairs permissions on existing directories. Their effective accessibility therefore d ...[truncated 2169 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store profiles outside the source tree in a private, per-user application-data directory. 2. Create every session directory with owner-only permissions and enforce those permissions even when the directory already exists: ```python self.base_dir.mkdir(parents=True, exist_ok=True, mode=0o700) os.chmod(self.base_dir, 0o700) for directory in (self.dianping_session_dir, self.xhs_session_dir): directory.mkdir(exist_ok=True, mode=0o700) os.chmod(directory, 0o700) ``` 3. Create `session_state.json` with mode `0600`, using a secure low-level open operation where necessary to avoid an unsafe creation window. 4. Validate directory ownership before use and refuse symlinks, unexpected owners, or group/world-accessible storage. 5. Delete the relevant browser profile when the application marks a session expired. 6. Provide explicit logout and per-platform revocation operations. 7. Document that the session directories contain sensitive authentication material and must not be committed, archived, or shared. 8. Add `sessions/` to repository ignore rules where applicable. 9. Where supported, protect session state using operating-system credential storage or an encrypted secret store rather than a general project directory. ]]>