T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gandi-api.js:66- Finding
Bearer Token Can Be Sent to an Arbitrary Configured HTTPS Endpoint
- Content
View full analysis
{ const token = tokenOverride || readToken(); const apiUrl = readApiUrl(); // Build URL with query parameters const url = new URL(endpoint, apiUrl); Object.entries(queryParams).forEach(([key, value]) => { if (value !== undefined && value !== null) { url.searchParams.append(key, value); } }); const options = { method, headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' } }; // Add Content-Type for requests with body if (data && ['POST', 'PUT', 'PATCH'].includes(method)) { options.headers['Content-Type'] = 'application/json'; } const req = https.request(url, options, (res) => { ``` ### Technical Analysis The API base URL is loaded from `~/.config/gandi/api_url` and used without validating its hostname, port, or expected Gandi origin. The request code subsequently attaches the Gandi Personal Access Token to every request through the `Authorization` header. Use of HTTPS protects the connection in transit but does not establish that the recipient is Gandi. An attacker-controlled server with a valid TLS certificate can receive the token if the configuration file is modified to reference that server. A custom endpoint can be useful for sandbox testing, but unrestricted destinations exceed the minimum s ...[truncated 1350 chars]- Remediation
View remediation