T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/configuration-available-regions.sh:12- Finding
TripGo API Credential Disclosure Through Unrestricted Base URL Overrides
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 3. **Validate the hostname against an explicit allowlist** Parse the URL using a robust URL parser and require the normalized hostname to match an approved TripGo host or explicitly configured enterprise deployment. Do not rely on substring matching, which can accept names such as `api.tripgo.com.attacker.example`. 4. **Separate custom endpoints from credential forwarding** Never attach `X-TripGo-Key` to an untrusted destination. Resolve and validate the destination before constructing the authenticated request. 5. **Constrain curl protocol and redirect behavior** Use settings such as: ```bash curl --proto '=https' \ --proto-redir '=https' \ --max-redirs 0 \ --fail-with-body \ --silent \ --show-error \ ... ``` If redirects are required, validate every redirect destination before forwarding authentication headers. 6. **Avoid API keys in command-line arguments** Remove or discourage `--api-key`, because command-line values may be exposed through process listings and shell history. Prefer a protected environment variable, secure file descriptor, or secret manager. 7. **Fail closed on placeholder credentials** Scripts using values such as `YOUR_API_KEY` or `your-api-key-here` should reject those placeholders explicitly rather than transmitting them. 8. **Apply the validation centrally** Introduce a shared request helper that validates the scheme and hostname and adds authenticatio ...[truncated 439 chars]