T09 · Insecure Skill Coding Practices
- Location
scripts/weeek_api.py:21- Finding
Bearer Authorization Token May Be Forwarded Across Redirects
- Content
View full analysis
Vulnerability Details
File Location:
scripts/weeek_api.py, lines 21–30
Vulnerability Type: Unsafe handling of authenticated HTTP redirects
Risk Level: Mediumpython def request(method, path, params=None, body=None): token = os.environ.get("WEEEK_TOKEN") if not token: raise SystemExit("WEEEK_TOKEN не задан в окружении") url = BASE_URL + path if params: query = urllib.parse.urlencode({k: v for k, v in params.items() if v is not None}, doseq=True) url = url + ("?" + query if query else "") data = None headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json", } if body is not None: data = json.dumps(body).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method=method) with urllib.request.urlopen(req) as resp: raw = resp.read().decode("utf-8") if not raw: return None try: return json.loads(raw) except json.JSONDecodeError: return rawTechnical Analysis
Sending
WEEEK_TOKENto the fixed WEEEK HTTPS API is necessary for the Skill's declared task-management functionality. However,urllib.request.urlopen()follows supported HTTP redirects automatically, and the implementation neither disables redirects nor validates the final response origin.Because the bearer token is placed in the ordinary request headers, redirect processing may copy the
Authorizationheader into a redirected request. Ifapi.weeek.netreturns a redirect to a different origin, the authenticated client may consequently disclose the token to that origin. The implementation also does not enforce an explicit HTTPS-only, same-host redirect policy.This is not evidence of intentional exfiltration: the original destination is the documented WEEEK API, and no attacker-controlled destination is e ...[truncated 1532 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable automatic redirects for authenticated API requests unless redirects are explicitly required by the WEEEK API.
- If redirects must be supported, implement a custom
urllib.request.HTTPRedirectHandlerthat permits redirects only when:- The destination scheme is
https. - The destination hostname is exactly
api.weeek.net. - The destination port remains the expected HTTPS port.
- The destination scheme is
- Strip the
Authorizationheader before following every cross-origin redirect, including redirects involving a hostname, scheme, or port change. - Validate the final response URL before processing its contents.
- Add a finite network timeout to
urlopen()to prevent indefinite blocking. - Add automated tests covering same-origin redirects, cross-origin redirects, HTTPS-to-HTTP redirects, and authorization-header removal.
- Document that users should issue narrowly scoped API tokens where WEEEK supports token-level permission restrictions and should revoke a token immediately if unintended redirection is observed.