T09 · Insecure Skill Coding Practices
Error
- Location
odoo_skill/sync/webhook.py:36- Finding
Webhook Server Publicly Binds Without Mandatory Authentication or Request Size Limits
- Content
View full analysis
None: """Handle an incoming webhook POST request.""" content_length = int(self.headers.get("Content-Length", 0)) if content_length == 0: self._respond(400, {"error": "Empty body"}) return body = self.rfile.read(content_length) # ── Signature verification ─────────────────────────────── if self.webhook_secret: signature = self.headers.get("X-Odoo-Signature", "") expected = hmac.new( self.webhook_secret.encode("utf-8"), body, hashlib.sha256, ).hexdigest() if not hmac.compare_digest(signature, expected): logger.warning("Webhook signature mismatch (remote=%s)", self.client_address[0]) self._respond(401, {"error": "Invalid signature"}) return ``` ```python def __init__( self, port: int = 8069, host: str = "0.0.0.0", secret: str = "", ) -> None: self.port = port self.host = host self.secret = secret ``` ```python def start(self) -> None: """Start the webhook server in a background thread.""" # Inject config into the handler class _WebhookHandler.webhook_secret = self.secret _WebhookHandler.callbacks = self._callbacks _WebhookHandler.default_callback = self._default_callback self._server = HTTPServer((self.host, self.port), _WebhookHandler) ``` ### Technical Analysis The webhook server binds to `0.0.0.0` by default, exposing it through every available network interface. At the same time, its shared HMAC secret defaults to an empty string. Signature verification is conditional on `self.webhook_secret`, so the def ...[truncated 2251 chars]- Remediation
View remediation
MAX_BODY_SIZE: self._respond(413, {"error": "Request body too large"}) return ``` 5. Require a timestamp and unique event identifier in signed requests, then reject stale timestamps and previously processed identifiers to prevent replay. 6. Place the server behind a TLS-enabled reverse proxy with network allowlisting and rate limiting. 7. Consider a threaded server with bounded concurrency and explicit read timeouts to reduce slow-client denial-of-service exposure. 8. Apply the same changes to the duplicated packaged implementation. ]]>