T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:51- Finding
Import-Time Authentication Uses Every Configured Feishu Account
- Content
View full analysis
log('ERROR', 'Failed to ensure bot infos:', err.message)); ``` ```javascript // Fetch from API // We only need to fetch for accounts that have credentials const promises = Object.entries(this.accountsConfig).map(async ([accountId, config]) => { if (!config.appId || !config.appSecret) return null; try { const token = await this._getTenantAccessToken(config.appId, config.appSecret); if (!token) return null; const res = await fetch('https://open.feishu.cn/open-apis/bot/v3/info', { headers: { 'Authorization': `Bearer ${token}` } }); const data = await res.json(); if (data.code === 0 && data.bot) { return { name: data.bot.app_name, open_id: data.bot.open_id, appId: config.appId, accountId: accountId }; } } catch (e) { log('ERROR', `Failed to fetch bot info for ${accountId}:`, e.message); } return null; }); ``` ```javascript async _getTenantAccessToken(appId, appSecret) { const cache = this.tokenCache.get(appId); if (cache && Date.now() < cache.expireTime) { return cache.token; } try { const response = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8' }, body: JSON.stringify({ app_id: appId, app_secret: appSecret }) }); const data = await response.json(); if (data.code === 0) { const expireTime = Date.now() + (data.expire - 300) * 1000; this.tokenCache.set(appId, { token: data.tenant_access_token, expireTime }); return data.tenant_acc ...[truncated 2415 chars]- Remediation
View remediation