T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:430- Finding
GitCode Access Token Exposed in URL Query Parameters and Process Arguments
- Content
View full analysis
"}' > /tmp/reply_body.json curl -s -X POST \ "https://api.gitcode.com/api/v5/repos///pulls//discussions//comments?access_token=${TOKEN}" \ -H "Content-Type: application/json" \ -d @/tmp/reply_body.json ``` ```bash TOKEN=$(python -c "from gitcode_cli.config import get_token; print(get_token())") echo '{"body": "暂不修改，建议级优化后续单独处理。"}' > /tmp/reply_body.json for did in "" "" ""; do curl -s -X POST \ "https://api.gitcode.com/api/v5/repos///pulls//discussions/${did}/comments?access_token=${TOKEN}" \ -H "Content-Type: application/json" \ -d @/tmp/reply_body.json done ``` The same unsafe query-parameter authentication pattern is also prescribed for retrieving comments: ```bash curl.exe -s "https://api.gitcode.com/api/v5/repos///pulls//comments?access_token=" ``` ### Technical Analysis GitCode authentication is necessary for the declared pull-request workflow. However, embedding the access token in the URL is not necessary and violates secure credential-handling practices. The expanded URL can expose the token through: - Process listings and process-monitoring software while `curl` is running. - HTTP client diagnostics and error reports. - Reverse-proxy, gateway, security-monitoring, or server access logs. - Debugging output and shell transcripts. - URL telemetry or request-recording systems. The Skill a ...[truncated 1562 chars]- Remediation
View remediation
//pulls//discussions//comments" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ --data-binary @/tmp/reply_body.json ``` 3. Do not print the token as part of a Python subprocess. Retrieve it through an approved credential helper or inject it through a protected runtime secret channel. 4. Use narrowly scoped and short-lived credentials limited to the required repository operations. 5. Ensure command tracing is disabled while handling credentials and never log request headers containing secrets. 6. Clear temporary shell variables after use: ```bash unset TOKEN ``` 7. Redact URL query strings and authorization headers from diagnostics, proxy logs, and API error reports. 8. Update all examples in both `SKILL.md` and `references/gitcode-api.md` so they do not encourage query-parameter authentication. 9. Revoke and rotate any token that may already have appeared in process captures or logs. ]]>