T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bridge-server.js:8- Finding
Unauthenticated and Cross-Origin Accessible Local POI API
- Content
View full analysis
{ let raw = ''; req.on('data', chunk => (raw += chunk)); req.on('end', () => resolve(raw)); req.on('error', reject); }); } function authOk(req) { if (!TOKEN) return true; return req.headers['x-clickmap-token'] === TOKEN; } ``` ```javascript const server = http.createServer(async (req, res) => { if (req.method === 'OPTIONS') { res.writeHead(204, { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET,POST,OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type, X-ClickMap-Token' }); return res.end(); } if (!authOk(req)) return send(res, 401, { ok: false, error: 'unauthorized' }); if (req.url === '/health' && req.method === 'GET') { return send(res, 200, { ok: true, service: 'clickmap-bridge', port: PORT, dataFile }); } if (req.url === '/api/pois' && req.method === 'GET') { return send(res, 200, { ok: true, ...loadData() }); } if (req.url === '/api/pois' && req.method === 'POST') { const raw = await readBody(req); let body; try { body = JSON.parse(raw || '{}'); } catch { return send(res, 400, { ok: false, error: 'invalid_json' }); } if (!Array.isArray(body.pois)) return send(res, 400, { ok: false, error: 'pois_array_required' }); const normalized = body.pois.map((p, idx) => ({ id: p.id || `poi-${Date.now()}-${idx}`, name: String(p.name || '').trim(), urlPa ...[truncated 4214 chars]- Remediation
View remediation