T09 · Insecure Skill Coding Practices
Error
- Location
index.js:106- Finding
Unrestricted authenticated requests can disclose the Feishu tenant token to arbitrary hosts
- Content
View full analysis
Vulnerability Details
File Location:
index.js:106-136
Vulnerability Type: Unrestricted credential forwarding
Risk Level: HighVulnerable Code
javascript async function fetchWithAuth(url, options = {}) { let token = await getToken(); let headers = { ...options.headers, 'Authorization': `Bearer ${token}` }; try { let res = await fetchWithRetry(url, { ...options, headers }); // Handle JSON Logic Errors (200 OK but code != 0) const clone = res.clone(); try { const data = await clone.json(); // Codes for invalid token: 99991663, 99991664, 99991661, 99991668 if ([99991663, 99991664, 99991661, 99991668].includes(data.code)) { throw new Error('TokenExpired'); } } catch (jsonErr) { // If response isn't JSON or TokenExpired, ignore here if (jsonErr.message === 'TokenExpired') throw jsonErr; } return res; } catch (e) { if (e.message.includes('HTTP 401') || e.message === 'TokenExpired') { console.warn(`[FeishuClient] Token expired. Refreshing...`); token = await getToken(true); headers = { ...options.headers, 'Authorization': `Bearer ${token}` }; return await fetchWithRetry(url, { ...options, headers }); } throw e; } }Technical Analysis
fetchWithAuthaccepts an unrestricted URL and unconditionally attaches the Feishu tenant bearer token to the request. It does not validate the URL scheme, hostname, port, or origin before transmitting the credential.The declared purpose of this helper is to make authenticated Feishu API requests. Therefore, attaching a Feishu token to non-Feishu destinations exceeds the minimum network privileges required by the Skill. The automatic token-refresh branch can also send ...[truncated 1560 chars]
- Remediation
View remediation
Remediation Suggestions
- Parse requests with the standard
URLclass and reject malformed URLs. - Require the
https:scheme. - Enforce an explicit allowlist of approved Feishu API hosts, such as the exact hostname required by the deployment.
- Prefer accepting relative Feishu API paths and joining them to a hardcoded trusted base URL rather than accepting arbitrary absolute URLs.
- Reject URLs containing unexpected ports, embedded credentials, or hostnames that merely end with a trusted-looking string.
- Ensure authorization headers are never forwarded across origins during redirects. Prefer disabling automatic redirects or manually validating every redirect destination.
- Separate generic unauthenticated fetching from authenticated Feishu requests so the credential-bearing function cannot be reused as a general-purpose network helper.
- Add tests confirming that HTTP URLs, external hosts, deceptive subdomains, and cross-origin redirects are rejected before token acquisition or transmission.
- Parse requests with the standard