T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/create_review.sh:36
- Finding
- Unvalidated API Endpoint Override Exposes Bearer Tokens and Source Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_review.sh:36, 79-80, 130-151`; `scripts/poll_review.sh:35, 105-106, 154-168`; `scripts/post_comment_feedback.sh:32, 67-68, 120-128`; `scripts/smoke_test_permissions.sh:35, 53-54, 137-146` **Vulnerability Type**: Arbitrary credential and sensitive-data transmission endpoint **Risk Level**: High ### Vulnerable Code The review creation script permits the API endpoint to be supplied through environment variables or a command-line argument: ```bash API_URL="${PROPEL_API_BASE_URL:-${PROPEL_API_URL:-https://api.propelcode.ai}}" ``` ```bash --api-url) API_URL="$(require_option_value "$1" "${2-}")" shift 2 ;; ``` It subsequently attaches the bearer token and sends the complete Git diff to that endpoint: ```bash BODY_FILE="$(mktemp)" CURL_CONFIG_FILE="$(mktemp)" chmod 600 "$CURL_CONFIG_FILE" trap 'rm -f "$BODY_FILE" "$CURL_CONFIG_FILE"' EXIT printf 'header = "Authorization: Bearer %s"\n' "$PROPEL_API_KEY" >"$CURL_CONFIG_FILE" printf 'header = "Content-Type: application/json"\n' >>"$CURL_CONFIG_FILE" HTTP_CODE="" for ((attempt = 1; attempt <= MAX_ATTEMPTS; attempt++)); do if ! HTTP_CODE="$( jq -n \ --rawfile diff "$DIFF_FILE" \ --arg repo "$REPO_SLUG" \ --arg base "$BASE_COMMIT" \ --arg head "$HEAD_COMMIT_SHA" \ --arg branch "$BRANCH_NAME" \ '({diff:$diff, repository:$repo, base_commit:$base} + (if $head != "" then {head_commit_sha:$head} else {} end) + (if $branch != "" then {branch:$branch} else {} end))' \ | curl -sS -o "$BODY_FILE" -w "%{http_code}" \ --config "$CURL_CONFIG_FILE" \ --data-binary @- \ "$API_URL/v1/reviews" )"; then ``` The polling and feedback scripts use the same endpoint-override pattern and attach the same credential: ```bash API_URL="${PROPEL_API_BASE_URL:-${PROPEL_API_URL:-https://api.propelcode.ai}}" ``` ```bash printf 'header = "Authorization: Bearer %s"\n' "$PROPEL_API_KEY ...[truncated 2493 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove endpoint overrides from production-facing helpers unless they are strictly required. 2. Enforce the canonical endpoint: ```bash API_URL="https://api.propelcode.ai" ``` 3. If custom endpoints are required for development, parse and validate the URL before creating the authorization header: - Require the `https` scheme. - Allowlist exact approved hostnames. - Reject embedded credentials, unexpected ports, fragments, and malformed URLs. - Do not rely on suffix matching such as `*.propelcode.ai` unless every subdomain is trusted. 4. Require an explicit, interactive security confirmation before sending credentials to a non-production endpoint. 5. Use separate test credentials with minimal scopes for development and smoke testing. 6. Apply the same validation consistently to `create_review.sh`, `poll_review.sh`, `post_comment_feedback.sh`, and `smoke_test_permissions.sh`. 7. Document that endpoint-related environment variables are security-sensitive and must not be inherited from untrusted CI jobs or repository configuration. ]]>