T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/queue.js:65- Finding
Missing Agent Authentication and Task-Level Authorization
- Content
View full analysis
') .description('Claim a task') .requiredOption('--agent ', 'Agent name') .action((taskId, opts) => { const db = initDb(); try { const t = claimTask(db, taskId, opts.agent); if (t) console.log(`Task ${taskId} claimed by ${opts.agent}`); else console.error(`Failed to claim task ${taskId} (already taken or not pending)`); } catch (e) { console.error(e.message); } closeDb(); }); task.command('complete ') .description('Complete a task') .option('--result-path ', 'Path to result file') .option('--summary ', 'Summary of result') .action((taskId, opts) => { const db = initDb(); try { completeTask(db, taskId, { resultPath: opts.resultPath, summary: opts.summary }); console.log(`Task ${taskId} completed.`); } catch (e) { console.error(e.message); } closeDb(); }); task.command('fail ') .description('Fail a task') .option('--reason ', 'Reason for failure') .action((taskId, opts) => { const db = initDb(); try { failTask(db, taskId, opts.reason); console.log(`Task ${taskId} marked as failed.`); } catch (e) { console.error(e.message); } closeDb(); }); ``` ```js export function claimTask(db, taskId, agentName) { // Wrap everything in a transaction — no stale reads outside const doClaim = db.transaction(() => { const task = getTask(db, taskId); if (!task) throw new Error(`Task ${taskId} not found`); if (task.status !== 'pending') return null; // Check dependencies inside the transaction if (task.depends_on.length > 0) { const placeholders = task.depends_on.map(() => '?').join(','); co ...[truncated 4217 chars]- Remediation
View remediation