T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/hik_open_device_management.py:107
- Finding
- OAuth credentials and bearer tokens can be transmitted to an arbitrary or plaintext endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hik_open_device_management.py:107-120`, `scripts/hik_open_device_management.py:187-218`, `scripts/hik_open_device_management.py:261-268`, and `scripts/hik_open_device_management.py:393` **Vulnerability Type**: Unrestricted credential destination and missing HTTPS enforcement **Risk Level**: High ### Vulnerable Code ```python def normalize_base_url(base_url: str) -> str: normalized = base_url.strip() if not normalized: raise ApiError("base URL must not be empty") return normalized.rstrip("/") def resolve_base_url(explicit_base_url: str | None) -> str: if explicit_base_url: return normalize_base_url(explicit_base_url) env_base_url = os.getenv(BASE_URL_ENV_VAR) if env_base_url: return normalize_base_url(env_base_url) return DEFAULT_BASE_URL ``` ```python def fetch_access_token( base_url: str, client_id: str, client_secret: str, timeout: float, ) -> dict[str, Any]: status, payload = http_json_request( method="POST", url=base_url.rstrip("/") + TOKEN_PATH, headers=None, timeout=timeout, form_body={ "client_id": client_id, "client_secret": client_secret, "grant_type": "client_credentials", "scope": "app", }, ) if status != 200 or "access_token" not in payload: error_code, error_message = summarize_error_payload(payload) raise ApiError( "failed to fetch access token: " f"http={status}, code={error_code}, message={error_message}" ) expires_in = int(payload.get("expires_in", 0)) return { "access_token": payload["access_token"], "expires_in": expires_in, "expires_at": time.time() + max(expires_in, 0), "token_type": payload.get("token_type", "bearer"), } ``` ```python token, refreshed = resolve_access_token(base_url, timeout, cache_file, expli ...[truncated 2826 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the URL with `urllib.parse.urlsplit` and reject malformed URLs. 2. Require `https` for all token and API requests. If local development requires HTTP, place it behind a clearly named, disabled-by-default development override that refuses production credentials. 3. Allowlist `api2.hik-cloud.com` by default. 4. Require explicit administrator configuration for additional trusted staging or private endpoints. 5. Reject URLs containing user information, fragments, unexpected ports, or ambiguous host representations. 6. Disable redirects for requests containing credentials, or validate every redirect target against the same scheme and hostname policy before following it. 7. Bind cached tokens to the normalized issuer origin and do not reuse a token after the base URL changes. 8. Add tests confirming rejection of `http://`, unapproved hosts, embedded credentials, and unsafe redirects. 9. Prefer separate credentials with reduced privileges for staging and custom endpoint configurations. ]]>