T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/http.ts:75- Finding
Google Maps API Key Disclosure Through JSON Parsing Error Output
- Content
View full analysis
= {}; let requestParams: Record | undefined = params; if (command.auth === "query") { requestParams = { ...params, key: apiKey }; } else { headers["X-Goog-Api-Key"] = apiKey; } ``` `scripts/lib/http.ts:38-42`: ```ts const timeoutMs = request.timeoutMs ?? DEFAULT_TIMEOUT_MS; const retries = request.retries ?? DEFAULT_RETRY_COUNT; const fullUrl = request.method === "GET" ? buildUrlWithParams(request.url, request.params) : request.url; ``` `scripts/lib/http.ts:68-79`: ```ts const response = await fetch(fullUrl, fetchOptions); clearTimeout(timer); let payload: unknown; try { payload = await response.json(); } catch (jsonError) { throw new CliError( `Failed to parse JSON response from ${fullUrl}: ${toErrorMessage(jsonError)}`, ExitCode.NETWORK, { cause: jsonError }, ); } ``` `scripts/gmaps.ts:125-132`: ```ts void main().catch((error: unknown) => { if (error instanceof CliError) { if (error.rawResponse !== undefined) { printJson(error.rawResponse); } else { process.stderr.write(`${error.message}\n`); } process.exit(error.exitCode); ``` ### Technical Analysis Legacy GET-based commands, including geocoding, reverse geocoding, elevation, and timezone operations, authenticate by adding `GOOGLE_MAPS_API_KEY` to the request query parameters. The HTTP layer then constructs `fullUrl`, which consequently contains the plaintext API key in a `key` query parameter. If the server response cannot be parsed as JSON, the exception message includes the entire `fullUrl`. The top-level CLI error handler writes this message directly to st ...[truncated 2159 chars]- Remediation
View remediation