T09 · Insecure Skill Coding Practices
Error
- Location
scripts/whoop_oauth_login.py:52- Finding
OAuth Authorization Flow Lacks State and Callback Validation
- Content
View full analysis
") code = parse_code(user_in) tok = exchange_code_for_token( code=code, client_id=client_id, client_secret=client_secret, redirect_uri=redirect_uri, ) ``` The associated parser at `scripts/whoop_oauth_login.py:34-44` only extracts the authorization code: ```python def parse_code(user_input: str) -> str: s = user_input.strip() if s.startswith("http://") or s.startswith("https://"): u = urllib.parse.urlparse(s) q = urllib.parse.parse_qs(u.query) code = (q.get("code") or [None])[0] if code: return code raise SystemExit("Could not find ?code= in the pasted redirect URL") return s ``` ### Technical Analysis The authorization request does not include a cryptographically random OAuth `state` parameter. The callback parser accepts a redirect URL from any HTTP or HTTPS origin, extracts only its `code`, and does not verify that its scheme, host, port, and path match the configured `WHOOP_REDIRECT_URI`. The authorization code is therefore not bound to the login transaction initiated by this process. Accepting a bare code further prevents callback-origin and state validation. This creates login CSRF or account-binding confusion risk: a valid authorization code generated through a different browser transaction can be submitted and stored by the Skill. PKCE is also absent. Although the client secret is required for exchang ...[truncated 1237 chars]- Remediation
View remediation