T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/opensubtitles-api.sh:5
- Finding
- Unvalidated API Host Can Receive OpenSubtitles Credentials<![CDATA[ ## Vulnerability Details **File Location**: `scripts/opensubtitles-api.sh:5-11, 73-104, 175, 209` **Vulnerability Type**: Unrestricted credential transmission to a configurable network destination **Risk Level**: High ### Vulnerable Code ```bash API_ROOT="https://api.opensubtitles.com/api/v1" base_url() { if [[ -n "${OPENSUBTITLES_BASE_URL:-}" ]]; then echo "https://${OPENSUBTITLES_BASE_URL}/api/v1" else echo "${API_ROOT}" fi } ``` ```bash api_get() { local base="$1" local path="$2" shift 2 local qs="$*" local url="${base}${path}" if [[ -n "$qs" ]]; then url+="?${qs}" fi curl -s -L \ -H "Accept: application/json" \ -H "Api-Key: ${OPENSUBTITLES_API_KEY}" \ -H "User-Agent: ${OPENSUBTITLES_USER_AGENT}" \ "$url" } api_post() { local base="$1" local path="$2" local body="$3" local auth_header="$4" curl -s \ -H "Accept: application/json" \ -H "Api-Key: ${OPENSUBTITLES_API_KEY}" \ -H "User-Agent: ${OPENSUBTITLES_USER_AGENT}" \ -H "Content-Type: application/json" \ ${auth_header:+-H "Authorization: Bearer ${auth_header}"} \ -d "$body" \ "${base}${path}" } ``` ```bash json=$(api_get "$(base_url)" "/subtitles" "$qs_str") ``` ```bash api_post "$(base_url)" "/download" "$body" "$token" | jq ``` ### Technical Analysis The `OPENSUBTITLES_BASE_URL` environment variable is inserted directly into a URL without validating that it identifies an authorized OpenSubtitles host. Every request made through this configurable base URL includes the OpenSubtitles API key. A download request also includes the bearer token. Although a dynamically returned OpenSubtitles API host is part of the documented service workflow, accepting an unrestricted hostname exceeds the minimum privileges needed by the Skill. The implementation should only transmit credentials to explicitly trusted OpenSubtitles domains. Search requests ...[truncated 1567 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse and validate `OPENSUBTITLES_BASE_URL` before using it. 2. Maintain an explicit allowlist of exact OpenSubtitles hostnames authorized by the service documentation. 3. Reject values containing: - URL schemes - User-information components such as `user@host` - Paths or query strings - Unexpected ports - IP literals - Trailing-dot or suffix-confusion hostnames 4. Do not use permissive suffix checks such as `*.opensubtitles.com` without proper DNS-name parsing. 5. Prefer accepting the login response programmatically, extracting only its hostname, and validating it before storing or using it. 6. Disable automatic cross-origin redirects for requests carrying sensitive headers. Resolve redirects separately and validate each destination before resending the API key. 7. Attach the API key and bearer token only after confirming that the final request origin is trusted. 8. Use `curl --fail-with-body --show-error` and explicit redirect limits to improve failure handling without exposing credentials. ]]>