T09 · Insecure Skill Coding Practices
Error
- Location
download_media.js:13- Finding
Unvalidated media token can escape the intended download directory
- Content
View full analysis
{ const req = https.request({ hostname: 'open.feishu.cn', // 关键: medias endpoint，不是 files endpoint path: `/open-apis/drive/v1/medias/${fileToken}/download`, method: 'GET', headers: { 'Authorization': `Bearer ${token}` } }, res => { if (res.statusCode !== 200) { let errData = ''; res.on('data', c => errData += c); res.on('end', () => reject(new Error(`HTTP ${res.statusCode}: ${errData}`))); return; } // Detect extension from content-type const ct = res.headers['content-type'] || ''; let ext = '.png'; if (ct.includes('jpeg') || ct.includes('jpg')) ext = '.jpg'; else if (ct.includes('gif')) ext = '.gif'; else if (ct.includes('webp')) ext = '.webp'; const outPath = finalPath || path.join( os.homedir(), '.openclaw', 'workspace', 'input', 'feishu_downloads', `${fileToken}${ext}` ); fs.mkdirSync(path.dirname(outPath), { recursive: true }); const ws = fs.createWriteStream(outPath); res.pipe(ws); ws.on('finish', () => resolve(outPath)); ws.on('error', reject); }); req.on('error', reject); req.end(); }); } async function main() { try { const token = await getTenantToken(); const outputDir = path.join(os.homedir(), '.openclaw', 'workspace', 'input', 'feishu_downloads'); fs.mkdir ...[truncated 2108 chars]- Remediation
View remediation