T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/crawlora.sh:32
- Finding
- Undocumented POST Capability Permits Unnecessary Transmission of Arbitrary Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 32–38, 48–53, and 92–99 **Vulnerability Type**: Excessive network capability and arbitrary request-body transmission **Risk Level**: Medium ### Vulnerable Code ```bash method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done ``` ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the indeed-research skill" >&2 exit 2 ;; esac ``` ```bash else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis The endpoint contract in `reference/endpoints.md` defines all three allowlisted routes—`/indeed/job`, `/indeed/locations/suggest`, and `/indeed/search`—as GET endpoints. Nevertheless, the helper accepts `-X POST`, accepts an arbitrary body through `-d` or a positional argument, and sends that body to `https://api.crawlora.net/api/v1`. This capability is not required for the declared Indeed search functionality and therefore exceeds least privilege. Although the destination host and route set are fixed, an agent can still be induced to place private user content, credentials, or other sensitive text into the request body. The receiving service obtains the HTTP request even if it subsequently rejects the unsupported method. The script does include useful protections: it fixes the API host, restricts paths, rejects curl `@file` query syntax, validates the API-key alphabet, and keeps the API key out of the process command line. It does not independently read arbitrary files through the body path. Exp ...[truncated 1578 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for `-X`, `-d`, POST requests, and arbitrary JSON request bodies because the documented endpoint catalog is entirely GET-only. 2. Set the method internally to GET rather than allowing callers to choose it. 3. Reject method-like options and unexpected positional arguments. 4. Add endpoint-specific parameter allowlists: - `/indeed/job`: `jk` - `/indeed/locations/suggest`: `q`, `limit` - `/indeed/search`: `q`, `l`, `radius`, `fromage`, `sort`, `page` 5. Validate documented formats and ranges, including the 16-character hexadecimal job key, numeric pagination and radius fields, and the `relevance`/`date` sort enumeration. 6. Retain the existing fixed HTTPS origin, route allowlist, API-key validation, private temporary configuration file, and rejection of curl file-upload syntax. 7. Add regression tests confirming that POST, `-d`, unknown parameters, unsupported paths, and malformed values are rejected before any network request occurs. A minimal hardening approach is: ```bash method="GET" while [ $# -gt 0 ]; do case "$1" in -X|-d) echo "custom methods and request bodies are not supported" >&2 exit 2 ;; *) args+=("$1") shift ;; esac done ``` ]]>