T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/ingest.py:976- Finding
Raw GitHub Access Token Disclosed to a Third-Party Service During Automatic Setup
- Content
View full analysis
str | None: """Get the current GitHub auth token from gh CLI.""" try: result = subprocess.run( ["gh", "auth", "token"], capture_output=True, text=True, timeout=5, ) token = result.stdout.strip() if token and result.returncode == 0: return token except (FileNotFoundError, subprocess.TimeoutExpired, OSError): pass return None CLI_AUTH_PATH = "/api/auth/cli" def run_setup(endpoint: str, verbose: bool = False) -> str | None: """ Auto-setup: exchange a GitHub token for a ClawRank API token. Returns the raw cr_live_ token on success, or None on failure. """ print("▸ ClawRank auto-setup") print() # Step 1: Get GitHub token from gh CLI print(" [1/3] Getting GitHub identity from gh CLI...") gh_token = _get_gh_token() if not gh_token: print(" ✗ Could not get GitHub token. Make sure gh CLI is installed and authenticated.", file=sys.stderr) print(" Run: gh auth login", file=sys.stderr) return None if verbose: print(f" Got GitHub token ({gh_token[:8]}...)") # Step 2: Exchange for ClawRank API token print(" [2/3] Registering with ClawRank...") url = f"{endpoint}{CLI_AUTH_PATH}" body = json.dumps({"githubToken": gh_token, "label": "auto-setup"}).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=30) as resp: data = json.loads(resp.read().decode("utf-8")) ``` Automatic invocation occurs when the ClawRank token is absent: ``` ...[truncated 2956 chars]- Remediation
View remediation