T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/imgen.js:103
- Finding
- Bearer Tokens and Sensitive Request Data Can Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/imgen.js:24, 103-109, 151-153` **Vulnerability Type**: Insecure transport of credentials and sensitive data **Risk Level**: Medium ### Vulnerable Code ```js const DEFAULT_API_URL = process.env.IMGEN_API_URL || 'https://api.laozhang.ai/v1/chat/completions'; ``` ```js function httpPost(urlString, headers, body) { return new Promise((resolve, reject) => { const url = new URL(urlString); const client = url.protocol === 'https:' ? https : http; const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method: 'POST', headers: { 'Content-Type': 'application/json', ...headers } }; ``` ```js const result = await httpPost(DEFAULT_API_URL, { 'Authorization': `Bearer ${token}` }, body); ``` ### Technical Analysis The API endpoint can be changed through the `IMGEN_API_URL` environment variable. The HTTP request implementation explicitly supports both HTTPS and unencrypted HTTP without requiring an additional security override or warning. When an endpoint beginning with `http://` is configured, the CLI transmits the following information without transport encryption: - The bearer API token in the `Authorization` header. - User-provided image-generation prompts. - Image-editing instructions. - Source image URLs included in editing requests. - Model and output-size parameters. Bearer tokens provide access to the associated API account to any party possessing them. Plaintext HTTP does not protect request headers or bodies from network interception or modification. The documented default endpoint uses HTTPS, so exploitation requires the endpoint to be changed to HTTP, whether intentionally, through unsafe setup instructions, or through manipulation of the process environment. ### Attack Path 1. A user or automation environment sets `IMGEN_API_URL` to an e ...[truncated 912 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject non-HTTPS API endpoints by default: ```js const url = new URL(urlString); if (url.protocol !== 'https:') { throw new Error('API endpoints must use HTTPS'); } ``` 2. If plaintext HTTP is needed for local development, require an explicit opt-in such as `IMGEN_ALLOW_INSECURE_HTTP=1` and restrict its use to loopback addresses. 3. Validate the endpoint before retrieving the token so credentials are never prepared for an unsafe destination. 4. Consider displaying the normalized endpoint hostname before the first credentialed request. 5. Document that bearer credentials must only be sent to trusted HTTPS endpoints. 6. Add tests confirming that `http://` endpoints are rejected and that malformed or unsupported URL schemes cannot receive credentials. ]]>