T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/youtrack_api.py:26
- Finding
- Permanent API Token Can Be Sent to an Arbitrary or Plaintext Origin<![CDATA[ ## Vulnerability Details **File Location**: `scripts/youtrack_api.py`, lines 26-43 and 50-64 **Vulnerability Type**: Unvalidated credential destination and insecure transport **Risk Level**: High ### Vulnerable Code ```python def __init__(self, base_url: str, token: Optional[str] = None): """ Initialize YouTrack API client. Args: base_url: Your YouTrack instance URL (e.g., https://sl.youtrack.cloud) token: Permanent API token (or set YOUTRACK_TOKEN env var) """ # Normalize base URL self.base_url = base_url.rstrip('/') self.token = token or os.environ.get('YOUTRACK_TOKEN') if not self.token: raise ValueError( "YouTrack token required. Set YOUTRACK_TOKEN env var or pass as argument." ) # Set up headers with bearer token auth self.headers = { 'Authorization': f'Bearer {self.token}', 'Accept': 'application/json', 'Content-Type': 'application/json' } ``` ```python def _make_request(self, method: str, endpoint: str, data: Optional[Dict] = None) -> Dict[str, Any]: """ Make an authenticated API request. Args: method: HTTP method (GET, POST, PUT, DELETE) endpoint: API endpoint (e.g., '/api/issues') data: Request body for POST/PUT Returns: Parsed JSON response """ url = urljoin(self.base_url, endpoint) req_data = None if data is not None: req_data = json.dumps(data).encode('utf-8') req = urllib.request.Request( url, data=req_data, headers=self.headers, method=method ) ``` ### Technical Analysis The caller supplies `base_url`, but the client does not validate its scheme, hostname, port, or relationship to an approved YouTrack instance. Every request generated by the client automatically receives the permanent bearer token through the shared `Authorization` header. If an `http://` URL is supplied, the token and associated request d ...[truncated 1797 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the supplied URL with `urllib.parse.urlsplit` and reject every scheme except `https`. 2. Reject URLs containing user information, fragments, unexpected ports, or malformed hostnames. 3. Support an administrator-configured allowlist of approved YouTrack hostnames. 4. Normalize the hostname before comparing it with the allowlist. 5. If local development requires HTTP, permit it only through an explicit opt-in flag and restrict it to loopback addresses. 6. Display or log the normalized credential destination without logging the token. 7. Require explicit user confirmation before sending credentials to a previously unknown host. 8. Use a narrowly scoped token where YouTrack supports applicable permission restrictions. 9. Rotate the token immediately if it may have been sent to an untrusted endpoint. ]]>