T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ga4_auth.py:65- Finding
OAuth authorization and token endpoints are accepted without provider validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ga4_auth.py, lines 65–76 and 126–149
Vulnerability Type: Unvalidated security-critical OAuth endpoints
Risk Level: HighTechnical Analysis
The client credential validator confirms only that
auth_uriandtoken_uriare nonempty strings. It does not verify that they use HTTPS or belong to trusted Google domains. These attacker-controlled values are subsequently passed toInstalledAppFlow, which uses them during authorization and token exchange.Relevant validation code:
python def validate_installed_client_file(path_value: str | os.PathLike[str]) -> Path: path = require_private_file(path_value) try: payload: Any = json.loads(path.read_text(encoding="utf-8")) except (OSError, UnicodeError, json.JSONDecodeError) as exc: raise AuthError("client credential JSON is unreadable or malformed") from exc installed = payload.get("installed") if isinstance(payload, dict) else None if not isinstance(installed, dict): raise AuthError("client credential JSON must contain a Desktop app 'installed' object") for field in ("client_id", "client_secret", "auth_uri", "token_uri"): if not isinstance(installed.get(field), str) or not installed[field]: raise AuthError(f"client credential JSON is missing installed.{field}") return pathThe unvalidated configuration is then used for OAuth:
python def authorize(client_file: Path, token_file: Path, port: int) -> Path: try: from google_auth_oauthlib.flow import InstalledAppFlow except ImportError as exc: raise AuthError("Google OAuth dependencies are not installed; use requirements.txt") from exc try: flow = InstalledAppFlow.from_client_secrets_file(str(client_file), scopes=SCOPES) credentials = flow.run_local_server( host="127.0.0.1", port=port, ...[truncated 2770 chars]- Remediation
View remediation
Remediation Suggestions
- Validate security-critical OAuth URLs before constructing
InstalledAppFlow. - Prefer exact allowlisted provider URLs from genuine Google Desktop client configurations, such as the expected Google authorization and token endpoints.
- At minimum, require HTTPS, reject user information, fragments, nonstandard ports, redirects to untrusted hosts, and hostnames outside an explicit Google allowlist.
- Do not rely on suffix checks such as
hostname.endswith("google.com"); compare normalized hostnames against exact approved values. - Validate the client type and other expected fields, including redirect URI semantics, before beginning authorization.
- Document that users must download the client file directly from their own Google Cloud Console and must not accept client files supplied by third parties.
- Where practical, display the normalized authorization and token hosts before opening the browser and require confirmation when they differ from compiled-in defaults.
- Add automated tests proving that HTTP endpoints, lookalike domains, user-information URL tricks, unexpected ports, and attacker-controlled token endpoints are rejected.
- If a suspicious client configuration has already been used, revoke the corresponding Google OAuth grant, delete the local token file, obtain a genuine client configuration, and authorize again.
- Validate security-critical OAuth URLs before constructing