T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/crawlora.sh:44
- Finding
- Overly Permissive HTTP Method and API Path Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 44–65 and 99–102 **Vulnerability Type**: Excessive request capabilities and insufficient route validation **Risk Level**: Low ### Vulnerable Code ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the zara-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the zara-research skill" >&2 exit 2 ;; esac case "$path" in /zara/categories) ;; /zara/category/*/products) ;; /zara/product/*) ;; /zara/search) ;; /zara/stores) ;; /zara/suggest) ;; *) echo "path is not in the zara-research skill catalog" >&2 exit 2 ;; esac ``` The accepted POST request is subsequently sent with the API credential: ```bash else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis All six Zara endpoints documented in `reference/endpoints.md` are read-only `GET` endpoints. The helper nevertheless accepts both `GET` and `POST`, including arbitrary JSON request bodies. POST access therefore exceeds the minimum capabilities necessary for the declared Zara research functionality. The path patterns `/zara/category/*/products` and `/zara/product/*` are also broader than the documented endpoint formats. The documentation requires numeric category and product identifiers, but shell wildcard matching accepts nonnumeric identifiers and may accept additional path content. Although characters such as `?`, `#`, `%`, path traversal sequences, and duplicate slashes are rejected, the al ...[truncated 1897 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove POST support and reject every method except GET: ```bash if [ "$method" != "GET" ]; then echo "only GET is supported by the zara-research skill" >&2 exit 2 fi ``` 2. Replace broad shell wildcard patterns with exact validation. Require numeric identifiers and prevent additional path segments: ```bash case "$path" in /zara/categories|/zara/search|/zara/stores|/zara/suggest) ;; *) if [[ "$path" =~ ^/zara/category/[0-9]+/products$ ]] || [[ "$path" =~ ^/zara/product/[0-9]+$ ]]; then : else echo "path is not in the zara-research skill catalog" >&2 exit 2 fi ;; esac ``` 3. Enforce endpoint-specific query parameters: - Reject all parameters for `/zara/categories`. - Permit only `query`, `section`, `limit`, and `offset` for `/zara/search`. - Permit only `query` for `/zara/suggest`. - Permit only `lat`, `lng`, `radius`, `pickup_only`, and `donation_only` for `/zara/stores`. - Reject query parameters on product and category detail routes unless explicitly documented. 4. Validate numeric ranges and types locally, including search limits, offsets, coordinates, radius, and boolean filters. 5. Keep the existing fixed HTTPS base URL, API-key character validation, private temporary curl configuration, cleanup trap, and rejection of curl `@file` query syntax, as these controls appropriately reduce credential redirection and local-file disclosure risks. ]]>