T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/redmine.js:1- Finding
Redmine API credentials can be transmitted over plaintext HTTP
- Content
View full analysis
and openclaw skills config epragma-redmine-issue set REDMINE_API_KEY '); } return REDMINE_URL; } function getApiKey() { if (REDMINE_URL?.startsWith('http')) { return API_KEY; } if (API_KEY?.startsWith('http')) { return process.env.REDMINE_BASE_URL || ''; } return API_KEY; } export { getBaseUrl, getApiKey }; async function request(endpoint, options = {}) { const baseUrl = getBaseUrl(); const apiKey = getApiKey(); const url = `${baseUrl}${endpoint}`; const headers = { 'Content-Type': 'application/json', 'X-Redmine-API-Key': apiKey, ...options.headers, }; const response = await fetch(url, { ...options, headers, }); ``` ### Technical Analysis The destination check accepts any value beginning with `http`, which includes unencrypted `http://` endpoints. Every API request then attaches the Redmine credential in the `X-Redmine-API-Key` header. Issue descriptions, comments, time-entry information, and mutation request bodies may also be transmitted over the same unencrypted connection. The configuration logic additionally assigns multiple meanings to credential-related environment variables. `REDMINE_API_KEY` m ...[truncated 2526 chars]- Remediation
View remediation