T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qbridge.sh:18- Finding
Unvalidated API Endpoint Override Can Expose Credentials and User Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/qbridge.sh, lines 18-68
Vulnerability Type: Unvalidated remote endpoint configuration leading to credential and data disclosure
Risk Level: MediumVulnerable Code
bash BASE="${QUANTUM_BRIDGE_URL:-https://quantum-api.gpupulse.dev/api/v1}" KEY="${QUANTUM_BRIDGE_KEY:-}" if [[ -z "$KEY" ]]; then echo "Error: Set QUANTUM_BRIDGE_KEY env var (get one free at https://quantum-api.gpupulse.dev)" >&2 exit 1 fi AUTH="Authorization: Bearer $KEY" CT="Content-Type: application/json" cmd="${1:-help}" shift || true case "$cmd" in transpile) file="${1:?Usage: qbridge transpile <file.qasm>}" qasm=$(cat "$file") curl -s -X POST "$BASE/transpile" -H "$AUTH" -H "$CT" \ -d "$(jq -n --arg q "$qasm" '{qasm: $q}')" ;; reverse) file="${1:?Usage: qbridge reverse <file.originir>}" ir=$(cat "$file") curl -s -X POST "$BASE/reverse" -H "$AUTH" -H "$CT" \ -d "$(jq -n --arg o "$ir" '{originir: $o}')" ;; validate) file="${1:?Usage: qbridge validate <file.originir>}" ir=$(cat "$file") curl -s -X POST "$BASE/validate" -H "$AUTH" -H "$CT" \ -d "$(jq -n --arg o "$ir" '{originir: $o}')" ;; consensus) file="${1:?Usage: qbridge consensus <agents.json>}" curl -s -X POST "$BASE/consensus" -H "$AUTH" -H "$CT" -d @"$file" ;; submit) file="${1:?Usage: qbridge submit <file.qasm> [simulator|wukong]}" backend="${2:-simulator}" qasm=$(cat "$file") curl -s -X POST "$BASE/submit" -H "$AUTH" -H "$CT" \ -d "$(jq -n --arg q "$qasm" --arg b "$backend" '{qasm: $q, backend: $b, shots: 1000}')" ;; poll) task_id="${1:?Usage: qbridge poll <task_id>}" curl -s "$BASE/submit/$task_id" -H "$AUTH" ;; balance) curl -s "$BASE/balance" -H "$AUTH" ;; backends) curl -s "$BASE/backends" -H "$AUTH" ;; ...[truncated 2293 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
QUANTUM_BRIDGE_URLconfigurability if custom endpoints are unnecessary and use a fixed trusted HTTPS endpoint. - If endpoint overrides are required, parse and validate the URL before constructing any authenticated request.
- Require the
httpsscheme and reject plaintext HTTP. - Enforce an explicit hostname allowlist, such as
quantum-api.gpupulse.dev, unless the user deliberately enables a documented custom-endpoint mode. - Never attach the bearer credential when the destination is outside the approved allowlist.
- Reject URLs containing unexpected user information, fragments, ports, redirects, or malformed hostnames as appropriate for the deployment.
- Configure
curlto fail safely and restrict redirects. If redirects are enabled, ensure authorization headers cannot be forwarded to an untrusted host. - Document custom endpoint behavior and require explicit confirmation before transmitting credentials or file contents to a non-default service.
- Store the API key in a dedicated secret manager or protected environment variable. Avoid plaintext project files such as
TOOLS.md; if such storage is unavoidable, restrict permissions and exclude the file from version control.
- Remove