T09 · Insecure Skill Coding Practices
Error
- Location
scripts/magento_client.py:45- Finding
OAuth-Authenticated Magento Traffic Can Be Sent Over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/magento_client.py:45-66
Vulnerability Type: Missing transport security enforcement for sensitive API traffic
Risk Level: HighVulnerable Code
python self.base_url = self._require_env("MAGENTO_BASE_URL").rstrip("/") self.timeout = int(self._env_with_fallback("MAGENTO_TIMEOUT", "30")) self.auth = OAuth1( client_key=self._require_env("MAGENTO_CONSUMER_KEY"), client_secret=self._require_env("MAGENTO_CONSUMER_SECRET"), resource_owner_key=self._require_env("MAGENTO_ACCESS_TOKEN"), resource_owner_secret=self._require_env("MAGENTO_ACCESS_TOKEN_SECRET"), signature_method="HMAC-SHA256", ) self.session = requests.Session() self.session.headers.update({"Content-Type": "application/json", "Accept": "application/json"}) # Setup retries for transient errors retry_strategy = Retry( total=3, backoff_factor=1, status_forcelist=[429, 500, 502, 503, 504], allowed_methods=["HEAD", "GET", "OPTIONS", "POST", "PUT", "DELETE"], ) adapter = HTTPAdapter(max_retries=retry_strategy) self.session.mount("http://", adapter) self.session.mount("https://", adapter)Authenticated requests are subsequently issued without validating the URL scheme:
python def get(self, path: str, params: dict | None = None) -> Any: resp = self.session.get(self._url(path), params=params, auth=self.auth, timeout=self.timeout) self._raise_for_status(resp) return resp.json() def post(self, path: str, body: dict) -> Any: resp = self.session.post(self._url(path), json=body, auth=self.auth, timeout=self.timeout) self._raise_for_status(resp) return resp.json() def put(self, path: str, body: dict) -> Any: resp = self.session.put(self._url(path), json=body, auth=self.auth, timeout=self.timeout) self._raise_for_status(resp) return resp.json() def delete(self, path: str) - ...[truncated 2501 chars]- Remediation
View remediation
Remediation Suggestions
- Parse
MAGENTO_BASE_URLduring client initialization and reject every scheme other thanhttps. - Reject malformed URLs and URLs containing embedded user information.
- If plaintext HTTP is required for isolated local development, require a clearly named opt-in such as
MAGENTO_ALLOW_INSECURE_HTTP=1and emit a prominent warning. - Restrict any development exception to loopback addresses or explicitly approved hosts.
- Retain normal TLS certificate verification and do not introduce
verify=False. - Consider applying an allowlist of expected Magento hostnames in managed deployments.
- Document HTTPS as mandatory rather than merely showing it in examples.
Example validation:
python parsed = urllib.parse.urlparse(self.base_url) if parsed.scheme != "https": raise ValueError("MAGENTO_BASE_URL must use HTTPS") if not parsed.hostname: raise ValueError("MAGENTO_BASE_URL must contain a valid hostname")- Parse