T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/strava_oauth_login.py:106- Finding
OAuth Authorization Flow Lacks State Validation
- Content
View full analysis
str: s = user_input.strip() if s.startswith("http://") or s.startswith("https://"): u = urllib.parse.urlparse(s) q = urllib.parse.parse_qs(u.query) code = (q.get("code") or [None])[0] if code: return code raise SystemExit("Could not find ?code= in the pasted redirect URL") return s ``` ```python q = urllib.parse.parse_qs(parsed.query) code = (q.get("code") or [None])[0] if code: got["code"] = code self.send_response(200) self.send_header("Content-Type", "text/plain; charset=utf-8") self.end_headers() self.wfile.write(b"OK. You can close this tab and return to OpenClaw.\n") ``` ```python params = { "client_id": client_id, "redirect_uri": redirect_uri, "response_type": "code", "approval_prompt": "auto", "scope": scopes, } ``` ### Technical Analysis The OAuth authorization request does not include a cryptographically random `state` parameter. Neither the copy-and-paste flow nor the loopback callback verifies that the received response belongs to the authorization request initiated by the current process. OAuth `state` is the standard correlation and CSRF protection mechanism for authorization redirects. Accepting any authorization code without validating its association with the active login attempt permits login CSRF or account substitution under suitable delivery conditions. The issue does not directly disclose the victim's Strava credentials. Its primary effect is that the Skill may exchange and persist a code associated with an unintended Strava account. ### Attack Path 1. An attacker initiates an OAuth authorization flow for the same configured Strava OAuth client and redire ...[truncated 1213 chars]- Remediation
View remediation