anomalyco / anomalyco/opencode
Opencode桌面版1.18.31密码泄露风险
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
现象
win桌面版本1.18.31，添加远程服务器，输入用户名、密码后可访问使用。卸载重装Opencode桌面版发现远程服务器信息仍然保留。通过检索发现 %APPDATA%\ai.opencode.desktop\opencode.global.dat 文件中暴露了远程服务器密码明文。而且，如果不删除服务器信息，即使卸载软件，该文件仍然保留相关信息。
处理方法
建议介意安全的win用户，立即删除远程服务器，不要使用Opencode桌面版管理远程服务器；必须使用的，要避免 %APPDATA%\ai.opencode.desktop\opencode.global.dat 文件被访问；卸载Opencode前，必须先删除服务器信息，避免密码残留造成泄露。
后续动作
其他版本我没有测试环境，还不知道是否存在相同问题。
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Windows desktop behavior on version 1.18.31 by adding a remote server, checking %APPDATA%\ai.opencode.desktop\opencode.global.dat, and then uninstalling and reinstalling. Trace where the remote-server credentials are persisted and removed; done means the password is not left in plaintext and is not retained after the relevant deletion or uninstall flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100