T09 · Insecure Skill Coding Practices
- Location
references/examples.md:20- Finding
Unrestricted Dynamic Dispatch in the Recommended Logseq HTTP Bridge
- Content
View full analysis
Vulnerability Details
File Location:
references/examples.md, lines 20-34
Vulnerability Type: Unauthenticated and unrestricted privileged API dispatch
Risk Level: HighVulnerable code:
javascript // bridge-plugin/index.js import '@logseq/libs'; logseq.ready({ async call({ method, namespace, args }) { const proxy = logseq[namespace]; if (!proxy || !proxy[method]) { throw new Error(`Unknown method: ${namespace}.${method}`); } return await proxy[method](...args); } }).then(() => { // Listen on HTTP or expose IPC console.log('Bridge ready'); });Technical Analysis
The recommended bridge accepts attacker-controlled
namespace,method, andargsvalues and dynamically invokes the selected Logseq API without an authorization check or an allowlist. The example also recommends exposing this dispatcher through HTTP or IPC, but does not require authentication, origin validation, request integrity protection, or loopback-only binding.This design exposes more than the editing operations described as the bridge's intended purpose. Depending on the APIs available in the installed Logseq version, a caller could access graph content, modify or delete blocks and pages, read graph configuration and filesystem metadata, or invoke privileged namespaces such as
logseq.Git.Checking whether a property exists is not an access-control mechanism. It only prevents calls to nonexistent methods and permits every available method, including destructive or unexpectedly privileged operations.
Attack Path
- A user follows the example and connects
call()to an HTTP or IPC endpoint. - The endpoint is reachable by an untrusted local process, another host, or potentially browser-originated requests, depending on its binding and CORS configuration.
- An attacker submits a request selecting a privileged namespace and method, with attacker-controlled arguments.
...[truncated 1176 chars]
- A user follows the example and connects
- Remediation
View remediation
Remediation Suggestions
- Do not dynamically dispatch arbitrary namespace and method names.
- Define a minimal, explicit allowlist of required operations, such as read-only block retrieval methods.
- Exclude destructive APIs, configuration mutation, Git command execution, UI injection, and any unnecessary namespace.
- Require strong authentication using a randomly generated secret stored with restrictive permissions.
- Bind the service exclusively to a Unix domain socket or
127.0.0.1; do not listen on all interfaces. - For HTTP transports, reject untrusted
Originvalues, disable permissive CORS, require an appropriate content type, and mitigate DNS rebinding. - Validate argument count, types, lengths, UUID formats, page names, and operation-specific constraints.
- Apply request-size limits, rate limiting, timeouts, and structured security logging.
- Introduce explicit user confirmation for destructive operations.
- Return sanitized errors rather than internal exception details.
- Document the bridge's trust boundary and provide a complete secure transport example rather than leaving security-sensitive transport behavior unspecified.