T09 · Insecure Skill Coding Practices
Error
- Location
scripts/customer-data-collector.js:76- Finding
OAuth credentials and bearer tokens can be transmitted to unrestricted configured origins
- Content
View full analysis
0) { const qs = new URLSearchParams(params).toString(); url += `?${qs}`; } const options = { method, headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' } }; if (method === 'POST') { options.body = JSON.stringify(params); } const resp = await fetch(url, options); ``` `scripts/tag-sync.js:79-92`: ```js const config = getOkkiConfig(); const body = new URLSearchParams({ client_id: config.clientId, client_secret: config.clientSecret, grant_type: 'client_credentials', scope: config.scope }); const resp = await fetch(`${config.baseUrl}/v1/oauth2/access_token`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() }); ``` `scripts/tag-sync.js:124-140`: ```js async function okkiGet(endpoint, token, baseUrl) { const resp = await fetch(`${baseUrl}${endpoint}`, { headers: { Authorization: token } }); if (!resp.ok) throw new Error(`OKKI GET ${endpoint} failed: ${resp.status}` ...[truncated 3218 chars]- Remediation
View remediation