T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hik_open_device_control.py:124- Finding
Credentials and Bearer Tokens Can Be Sent to an Arbitrary or Unencrypted Origin
- Content
View full analysis
str: normalized = base_url.strip() if not normalized: raise ApiError("base URL must not be empty") return normalized.rstrip("/") ``` ```python def fetch_access_token( base_url: str, client_id: str, client_secret: str, timeout: float, ) -> dict[str, Any]: status, payload = http_json_request( method="POST", url=base_url.rstrip("/") + TOKEN_PATH, headers=None, timeout=timeout, form_body={ "client_id": client_id, "client_secret": client_secret, "grant_type": "client_credentials", "scope": "app", }, ) ``` ```python token, refreshed = resolve_access_token(base_url, timeout, cache_file, explicit_token) headers = {"Authorization": f"Bearer {token}"} status, payload = http_json_request( method=spec.method, url=spec.build_url(base_url), headers=headers, timeout=timeout, json_body=spec.json_body, ) ``` ### Technical Analysis The Skill legitimately needs to transmit OAuth client credentials to obtain an access token and then use that bearer token to invoke the declared Hik-Cloud device APIs. However, the destination is not constrained to a trusted HTTPS origin. The `normalize_base_url` function only removes whitespace and a trailing slash. It does not: - Require the `https` scheme. - Restrict the hostname to the official Hik-Cloud service or an approved allowlist. - Reject embedded URL credentials, unexpected ports, fragments, or malformed origins. - Separate the OAuth authorization server from the business API origin. - Establish a high ...[truncated 2038 chars]- Remediation
View remediation