T09 · Insecure Skill Coding Practices
Error
- Location
scripts/suno-client.mjs:13- Finding
Unrestricted API Origin Override Can Expose Credentials and Uploaded Data
- Content
View full analysis
controller.abort(), options.timeout || 30_000); try { const response = await fetch(`${BASE_URL}${path}`, { ...options, signal: controller.signal }); ``` ```js async function startAuthorization(options = {}) { return withCredentialLock(async () => { const current = await loadCredentials(); if (options.expectedKey && current?.skill_key !== options.expectedKey) { throw new ClientError("credentials_changed", "授权已由另一进程更新，请确认后重试当前操作"); } const credentials = options.rotate || !current ? createSkillCredentials() : current; const result = await fetchJSON("/mcp/auth/start", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ skill_key: credentials.skill_key, client_instance_id: credentials.client_instance_id, client_name: CLIENT_NAME, skill_version: SKILL_VERSION, }), }); ``` ```js async function authorizedRequest(method, pathname, body, options = {}) { method = method.toUpperCase(); if (!ALLOWED_METHODS.has(method)) { throw new ClientError("invalid_method", "只允许 GET 或 POST 请求"); } validateAPIPath(pathname); const c ...[truncated 2732 chars]- Remediation
View remediation