T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/customer-data-collector.js:76
- Finding
- OAuth credentials and bearer tokens can be transmitted to unrestricted configured origins<![CDATA[ ## Vulnerability Details **File Location**: `scripts/customer-data-collector.js:76-89`, `scripts/customer-data-collector.js:107-130`, `scripts/tag-sync.js:79-92`, and `scripts/tag-sync.js:124-140` **Vulnerability Type**: Unvalidated security-sensitive network destination **Risk Level**: High ### Vulnerable Code `scripts/customer-data-collector.js:76-89`: ```js const config = getOkkiConfig(); const body = new URLSearchParams({ client_id: config.clientId, client_secret: config.clientSecret, grant_type: 'client_credentials', scope: config.scope }); const resp = await fetch(config.tokenUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() }); ``` `scripts/customer-data-collector.js:107-130`: ```js const config = getOkkiConfig(); const baseUrl = config.baseUrl; if (!token) token = await getAccessToken(); let url = `${baseUrl}${urlPath}`; if (method === 'GET' && Object.keys(params).length > 0) { const qs = new URLSearchParams(params).toString(); url += `?${qs}`; } const options = { method, headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' } }; if (method === 'POST') { options.body = JSON.stringify(params); } const resp = await fetch(url, options); ``` `scripts/tag-sync.js:79-92`: ```js const config = getOkkiConfig(); const body = new URLSearchParams({ client_id: config.clientId, client_secret: config.clientSecret, grant_type: 'client_credentials', scope: config.scope }); const resp = await fetch(`${config.baseUrl}/v1/oauth2/access_token`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() }); ``` `scripts/tag-sync.js:124-140`: ```js async function okkiGet(endpoint, token, baseUrl) { const resp = await fetch(`${baseUrl}${endpoint}`, { headers: { Authorization: token } }); if (!resp.ok) throw new Error(`OKKI GET ${endpoint} failed: ${resp.status}` ...[truncated 3218 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement a centralized URL validator for every credential-bearing request: - Parse URLs with `new URL(...)`. - Require `url.protocol === 'https:'`. - Allow only explicitly documented OKKI hostnames. - Reject usernames, passwords, fragments, nonstandard ports unless required, and malformed URLs. - Resolve and reject loopback, link-local, private, multicast, and cloud metadata addresses where applicable. 2. Validate origin consistency: - Require the token endpoint and API base URL to match approved origins. - Do not permit a token obtained for one origin to be sent to another. - Construct endpoint paths from a trusted base rather than accepting complete arbitrary URLs. 3. Control redirect behavior: - Use `redirect: 'error'` or manually validate every redirect target. - Never follow a cross-origin redirect while sending a client secret or authorization header. 4. Reduce credential scope: - Use separate least-privilege OAuth clients for read-only collection and tag-writing operations. - Limit scopes to required customer, order, interaction, and tag operations. - Rotate credentials if configuration integrity may have been compromised. 5. Protect configuration integrity: - Store the external configuration in a directory writable only by the Skill owner. - Validate ownership and permissions before reading it. - Prefer deployment-managed secret injection over loading a broad shared `.env` file. 6. Add tests that confirm rejection of HTTP, unknown hosts, embedded credentials, redirects, loopback addresses, and metadata-service destinations. ]]>