T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fns.py:91
- Finding
- Sensitive credentials and vault data can be transmitted over an insecure or attacker-controlled endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fns.py`, lines 91–109 and 162–171 **Vulnerability Type**: Missing transport security and destination validation **Risk Level**: High ### Vulnerable Code ```python def build_url(base_url: str, path: str, query: Optional[Dict[str, Any]] = None) -> str: base = base_url.rstrip('/') if not path.startswith('/'): path = '/' + path url = base + path if query: clean = {k: v for k, v in query.items() if v is not None and v != ''} if clean: url += '?' + urllib.parse.urlencode(clean) return url def request_json(method: str, url: str, *, token: Optional[str] = None, payload: Optional[Dict[str, Any]] = None, timeout: int = DEFAULT_TIMEOUT, accept_non_json: bool = False) -> Any: data = None headers = {} if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode('utf-8') headers['Content-Type'] = 'application/json' if token: headers['Authorization'] = token if token.lower().startswith('bearer ') else f'Bearer {token}' req = urllib.request.Request(url=url, data=data, method=method.upper(), headers=headers) ``` The login operation passes credentials and a password to the same unrestricted destination: ```python def cmd_login(args: argparse.Namespace) -> None: cfg = effective_config(args) require(cfg, 'baseUrl', 'credentials', 'password') data = request_json( 'POST', build_url(cfg['baseUrl'], '/user/login'), payload={'credentials': cfg['credentials'], 'password': cfg['password']}, timeout=cfg['timeoutSeconds'], ) ``` ### Technical Analysis The remote network behavior is necessary for the declared Fast Note Sync functionality. However, the implementation accepts an arbitrary `baseUrl` from command-line arguments, environment variables, or configuration files without validating its scheme or destination. Consequently, the client permits plain HTTP ...[truncated 1855 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `baseUrl` with `urllib.parse.urlsplit` and reject every scheme other than `https`. 2. Reject URLs containing unexpected user-information components, fragments, malformed hosts, or ambiguous encodings. 3. Permit plain HTTP only through an explicit development-only option such as `--allow-insecure-http`, accompanied by a prominent warning. Consider limiting that exception to loopback addresses. 4. Display the normalized destination host before the initial login and require explicit approval when it changes. 5. Consider supporting an administrator-defined hostname allowlist or certificate pinning for managed deployments. 6. Prevent redirects from forwarding authorization headers or sensitive request bodies to another origin. 7. Document that the endpoint receives authentication data and vault content and must be trusted. 8. Add tests confirming that HTTP, unsupported schemes, malformed URLs, and cross-origin redirects are rejected. ]]>