T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:45- Finding
Webhook Events Are Persisted and Dispatched Without Mandatory Authentication
- Content
View full analysis
dict: return { "id": self.id, "source": self.source, "timestamp": self.timestamp, "headers": self.headers, "parsed": self.parsed, } ``` ```python def _save_events(self): with open(self.log_file, "w", encoding="utf-8") as f: json.dump({"events": self.events[-500:]}, f, ensure_ascii=False, indent=2) ``` ```python def receive(self, event: WebhookEvent) -> dict: """处理接收到的webhook""" event_dict = event.to_dict() self.events.append(event_dict) self._save_events() result = {"received": True, "id": event.id, "source": event.source} # 查找匹配的handler event_type = event.parsed.get("event", "generic") if event_type in self.handlers: try: handler_result = self.handlers[event_type](event.parsed) result["handler_result"] = handler_result result["processed"] = True except Exception as e: result["error"] = str(e) result["processed"] = False else: result["processed"] = False result["note"] = f"No handler for event type: {event_type}" return result def verify_github_signature(self, payload: str, signature: str, secret: str) -> bool: """验证GitHub webhook签名""" expected = "sha256=" + hmac.new( secret.encode(), payload.encode(), hashlib.sha256 ).hexdigest() return hmac.compare_digest(expected, signature) ``` ### Technical Analysis The `receive()` method accepts a `WebhookEvent`, stores it, and dispatches its parsed payload to a registered handler without requiring authentication or integrity verification. Although `verify_github_signa ...[truncated 2799 chars]- Remediation
View remediation