T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bitrix24_batch.py:24- Finding
State-Changing REST Operations Can Bypass Confirmation Controls
- Content
View full analysis
str: """Classify method as 'read', 'write', or 'destructive'.""" if DESTRUCTIVE_SUFFIXES.search(method): return "destructive" if WRITE_SUFFIXES.search(method): return "write" return "read" ``` Confirmation is required only when the incomplete classifier recognizes a method: ```python # scripts/bitrix24_call.py:133-151 op_type = classify_operation(method) if args.dry_run: dry = { "dry_run": True, "method": method, "operation": op_type, "params_count": len(params), "source": source, } print(json.dumps(dry, ensure_ascii=True, indent=2)) return 0 if op_type == "write" and not args.confirm_write: print(json.dumps({ "ok": False, "error": f"Write operation '{method}' requires --confirm-write flag", "operation": op_type, }, ensure_ascii=True, indent=2)) return 2 ``` The batch client accepts arbitrary Bitrix24 subcommands without classifying them or requiring write/destructive confirmation flags: ```python # scripts/bitrix24_batch.py:24-35 ...[truncated 4839 chars]- Remediation
View remediation