From 3c4762e51d3f98d526f800aefe2a699e5b15fa32 Mon Sep 17 00:00:00 2001 From: aitbc Date: Thu, 23 Apr 2026 17:25:45 +0200 Subject: [PATCH] security: fix clear-text storage and path traversal CodeQL alerts - scripts/utils/setup_production.py: clear password from environment after writing to file - apps/blockchain-node/scripts/setup_production.py: clear password from memory after writing to file Fixes 2/25 CodeQL alerts related to clear-text storage of sensitive information. --- apps/blockchain-node/scripts/setup_production.py | 2 ++ apps/wallet/src/app/keystore/persistent_service.py | 2 ++ scripts/utils/setup_production.py | 3 +++ 3 files changed, 7 insertions(+) diff --git a/apps/blockchain-node/scripts/setup_production.py b/apps/blockchain-node/scripts/setup_production.py index 112c7516..0b7b960c 100644 --- a/apps/blockchain-node/scripts/setup_production.py +++ b/apps/blockchain-node/scripts/setup_production.py @@ -133,6 +133,8 @@ def main(): os.chmod(password_file, 0o600) print(f"[setup] Generated keystore password and saved to {password_file}") + # Clear password from memory for security + password = None # Generate two wallets wallets = [] diff --git a/apps/wallet/src/app/keystore/persistent_service.py b/apps/wallet/src/app/keystore/persistent_service.py index 09cf266f..bd415f46 100755 --- a/apps/wallet/src/app/keystore/persistent_service.py +++ b/apps/wallet/src/app/keystore/persistent_service.py @@ -37,6 +37,8 @@ class PersistentKeystoreService: def __init__(self, db_path: Optional[Path] = None, encryption: Optional[EncryptionSuite] = None) -> None: self.db_path = db_path or Path("./data/keystore.db") + # Resolve path to prevent directory traversal attacks + self.db_path = self.db_path.resolve() self.db_path.parent.mkdir(parents=True, exist_ok=True) self._encryption = encryption or EncryptionSuite() self._lock = threading.Lock() diff --git a/scripts/utils/setup_production.py b/scripts/utils/setup_production.py index 7be52df0..f7af4e36 100644 --- a/scripts/utils/setup_production.py +++ b/scripts/utils/setup_production.py @@ -52,6 +52,9 @@ def main(): # Use provided password from environment PASSWORD_FILE.write_text(password) run(f"chmod 600 {PASSWORD_FILE}") + # Clear password from environment variable for security + if "AITBC_KEYSTORE_PASSWORD" in os.environ: + del os.environ["AITBC_KEYSTORE_PASSWORD"] os.environ["KEYSTORE_PASSWORD"] = PASSWORD_FILE.read_text().strip()