T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/weeek_api.py:21
- Finding
- Bearer Authorization Token May Be Forwarded Across Redirects## Vulnerability Details **File Location**: `scripts/weeek_api.py`, lines 21–30 **Vulnerability Type**: Unsafe handling of authenticated HTTP redirects **Risk Level**: Medium ```python def request(method, path, params=None, body=None): token = os.environ.get("WEEEK_TOKEN") if not token: raise SystemExit("WEEEK_TOKEN не задан в окружении") url = BASE_URL + path if params: query = urllib.parse.urlencode({k: v for k, v in params.items() if v is not None}, doseq=True) url = url + ("?" + query if query else "") data = None headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json", } if body is not None: data = json.dumps(body).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method=method) with urllib.request.urlopen(req) as resp: raw = resp.read().decode("utf-8") if not raw: return None try: return json.loads(raw) except json.JSONDecodeError: return raw ``` ### Technical Analysis Sending `WEEEK_TOKEN` to the fixed WEEEK HTTPS API is necessary for the Skill's declared task-management functionality. However, `urllib.request.urlopen()` follows supported HTTP redirects automatically, and the implementation neither disables redirects nor validates the final response origin. Because the bearer token is placed in the ordinary request headers, redirect processing may copy the `Authorization` header into a redirected request. If `api.weeek.net` returns a redirect to a different origin, the authenticated client may consequently disclose the token to that origin. The implementation also does not enforce an explicit HTTPS-only, same-host redirect policy. This is not evidence of intentional exfiltration: the original destination is the documented WEEEK API, and no attacker-controlled destination is e ...[truncated 1532 chars]
- Remediation
- ## Remediation Suggestions 1. Disable automatic redirects for authenticated API requests unless redirects are explicitly required by the WEEEK API. 2. If redirects must be supported, implement a custom `urllib.request.HTTPRedirectHandler` that permits redirects only when: - The destination scheme is `https`. - The destination hostname is exactly `api.weeek.net`. - The destination port remains the expected HTTPS port. 3. Strip the `Authorization` header before following every cross-origin redirect, including redirects involving a hostname, scheme, or port change. 4. Validate the final response URL before processing its contents. 5. Add a finite network timeout to `urlopen()` to prevent indefinite blocking. 6. Add automated tests covering same-origin redirects, cross-origin redirects, HTTPS-to-HTTP redirects, and authorization-header removal. 7. Document that users should issue narrowly scoped API tokens where WEEEK supports token-level permission restrictions and should revoke a token immediately if unintended redirection is observed.