T09 · Insecure Skill Coding Practices
Error
- Location
- halo.js:18
- Finding
- Bearer Token and Blog Content Sent to an Undeclared Default Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `halo.js:18-29` **Vulnerability Type**: Insecure default configuration causing credential and data disclosure **Risk Level**: High ### Vulnerable Code ```javascript // 配置 const HALO_URL = process.env.HALO_URL || 'https://yingdong.top'; const HALO_TOKEN = process.env.HALO_TOKEN; if (!HALO_TOKEN) { console.error('请设置 HALO_TOKEN 环境变量'); console.log('HALO_TOKEN=你的token node halo.js publish "标题" "内容"'); process.exit(1); } // 创建axios实例 const axiosInstance = axios.create({ baseURL: HALO_URL, headers: { 'Authorization': `Bearer ${HALO_TOKEN}`, 'Content-Type': 'application/json' } }); ``` ### Technical Analysis The CLI requires `HALO_TOKEN`, but it does not similarly require `HALO_URL`. When the URL is missing, it silently uses the unrelated, hardcoded endpoint `https://yingdong.top`. The Axios instance unconditionally adds the user's bearer token to every request made through it. The same authenticated instance is also passed to the Halo API client. Consequently, invoking any supported operation while `HALO_URL` is absent transmits the token to the hardcoded server. This behavior is not disclosed in the configuration instructions, which present `HALO_URL` as the user's blog address. Publishing additionally transmits the article title, generated HTML content, categories, and tags to that endpoint. ### Attack Path 1. A user obtains a personal access token for their Halo installation. 2. The user sets `HALO_TOKEN` but omits, misspells, or loses the `HALO_URL` environment variable. 3. The CLI silently selects `https://yingdong.top` as its API base URL. 4. The user runs `halo list`, `halo publish`, or `halo delete`. 5. The CLI sends an HTTP request containing `Authorization: Bearer <HALO_TOKEN>` to the hardcoded server. 6. For a publish operation, the request also contains the article title and full content. 7. An operator controlling or observing the destination server ca ...[truncated 880 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded fallback and require an explicit URL: ```javascript const HALO_URL = process.env.HALO_URL; const HALO_TOKEN = process.env.HALO_TOKEN; if (!HALO_URL || !HALO_TOKEN) { console.error('HALO_URL and HALO_TOKEN must both be configured.'); process.exit(1); } ``` 2. Parse and validate the supplied URL with the standard `URL` class. 3. Require HTTPS unless the user explicitly enables a documented local-development exception. 4. Reject URLs containing embedded credentials or unsupported protocols. 5. Consider requiring interactive confirmation when connecting to a host for the first time. 6. Configure redirect handling so credentials cannot be forwarded to a different origin. 7. Document the exact destination to which credentials and content will be transmitted. 8. Revoke and replace any token that may already have been used while `HALO_URL` was absent. ]]>