T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/smart.py:25
- Finding
- Authentication Credentials Can Be Transmitted to Untrusted Configured Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `scripts/smart.py`, lines 25-63 **Vulnerability Type**: Unrestricted transmission of authentication material to user-configurable endpoints **Risk Level**: High ### Vulnerable Code ```python def ha_control(config, entity_id, action): ha = config.get("homeassistant") if not ha or '.' not in entity_id: return False domain = entity_id.split('.')[0] svc = "turn_on" if action == "on" else "turn_off" url = f"{ha['url']}/api/services/{domain}/{svc}" headers = {"Authorization": f"Bearer {ha['token']}"} try: r = requests.post(url, headers=headers, json={"entity_id": entity_id}, timeout=5) return r.status_code == 200 except: return False # --- Engine B: Tuya Smart --- def tuya_request(t_conf, method, path, body=None): import time aid, secret = t_conf['access_id'], t_conf['access_secret'] endpoint = t_conf['endpoint'] t = str(int(time.time() * 1000)) def calc_sign(msg): return hmac.new(secret.encode(), msg.encode(), hashlib.sha256).hexdigest().upper() r_tk = requests.get(f"{endpoint}/v1.0/token?grant_type=1", headers={"client_id": aid, "sign": calc_sign(aid + t), "t": t, "sign_method": "HMAC-SHA256"}) token = r_tk.json().get("result", {}).get("access_token") t = str(int(time.time() * 1000)) body_hash = hashlib.sha256((json.dumps(body) if body else "").encode()).hexdigest() string_to_sign = f"{method}\n{body_hash}\n\n{path}" sign = hmac.new(secret.encode(), (aid + token + t + string_to_sign).encode(), hashlib.sha256).hexdigest().upper() headers = {"client_id": aid, "access_token": token, "sign": sign, "t": t, "sign_method": "HMAC-SHA256", "Content-Type": "application/json"} res = requests.request(method, endpoint + path, headers=headers, json=body) return res.json().get("success", False) ``` ### Technical Analysis Both Home Assistant and Tuya destinations are read directly fr ...[truncated 2599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for every Tuya API endpoint and reject cleartext HTTP. 2. Allowlist the documented official Tuya regional API hostnames instead of accepting an arbitrary host. 3. Parse URLs with a standard URL parser and reject embedded credentials, fragments, unexpected schemes, and unexpected ports. 4. Restrict Home Assistant endpoints to local or explicitly trusted hosts by default. Require a clear opt-in and warning before sending a token to a public address. 5. Warn or fail closed when a Home Assistant URL uses HTTP outside loopback or a trusted private network. Prefer HTTPS even on private networks. 6. Store configuration with owner-only permissions, such as mode `0600`, and verify permissions before loading credentials. 7. Use narrowly scoped service accounts and rotate any credentials that may have been transmitted to an untrusted endpoint. 8. Add connection and read timeouts to every request, including both Tuya requests. 9. Validate TLS certificates and do not introduce a certificate-verification bypass. 10. Update the documentation to accurately explain which user-configured destinations may receive credentials and smart-home metadata. ]]>