T09 · Insecure Skill Coding Practices
Error
- Location
scripts/idfm.py:238- Finding
Unrestricted API Base URL Allows IDFM Credential Exfiltration
- Content
View full analysis
dict: req = urllib.request.Request(url) req.add_header("apikey", api_key) req.add_header("accept", "application/json") try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: raw = resp.read().decode("utf-8") return json.loads(raw) except urllib.error.HTTPError as e: body = None try: body = e.read().decode("utf-8", errors="replace") except Exception: pass raise PrimError(f"HTTP {e.code} {e.reason}: {body or ''}".strip()) from e except urllib.error.URLError as e: raise PrimError(f"Network error: {e}") from e ``` The client obtains the sensitive credential from the environment and builds requests using an arbitrary base URL: ```python class PrimClient: def __init__(self, api_key: str | None = None, base_url: str = BASE_URL): self.api_key = api_key or os.environ.get("IDFM_PRIM_API_KEY") if not self.api_key: raise PrimError("Missing IDFM_PRIM_API_KEY env var") self.base_url = base_url.rstrip("/") def get(self, path: str, params: dict | None = None) -> dict: base = f"{self.base_url}/{path.lstrip('/')}" qs = urllib.parse.urlencode(params or {}, doseq=True) url = f"{base}?{qs}" if qs else base return _http_get_json(url, self.api_key) ``` The command-line interface exposes the destination without validation: ```python p.add_argument( "--base-url", default=BASE_URL, help="override PRIM base URL (default: %(default)s)", ) ``` The unvalidated value is ...[truncated 2496 chars]- Remediation
View remediation
str: parsed = urlsplit(value) if ( parsed.scheme != ALLOWED_SCHEME or parsed.hostname != ALLOWED_HOST or parsed.port not in ALLOWED_PORTS or parsed.username is not None or parsed.password is not None or parsed.query or parsed.fragment or parsed.path.rstrip("/") != ALLOWED_PATH ): raise PrimError("Untrusted PRIM base URL") return value.rstrip("/") ``` 3. **Validate the destination before retrieving the API key.** This reduces the chance that future code paths accidentally expose the credential to an untrusted endpoint. 4. **Do not send production credentials to test servers.** If endpoint substitution is needed for automated tests, inject a separate dummy credential and restrict the feature to an explicit test mode. 5. **Require HTTPS and reject redirects to untrusted origins.** Ensure every redirect remains on the exact approved HTTPS origin before forwarding the authentication header. 6. **Rotate the API key if the vulnerable option has been used with any untrusted destination.** Review relevant API usage and quota logs for unauthorized requests. ]]>