T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/notion-sync.js:8- Finding
Undeclared Access to Local Notion Credentials and Database Records
- Content
View full analysis
{ const opts = { hostname: 'api.notion.com', path: urlPath, method: method, headers: { 'Authorization': 'Bearer ' + API_KEY, 'Notion-Version': '2025-09-03', 'Content-Type': 'application/json' } }; const req = https.request(opts, (res) => { let data = ''; res.on('data', c => data += c); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(new Error('Parse error: ' + data.substring(0, 200))); } }); }); req.on('error', reject); if (body) req.write(JSON.stringify(body)); req.end(); }); } ``` ```javascript const result = await notion('POST', '/v1/pages', { parent: { database_id: DB_ID }, properties: { 'Name': { title: [{ text: { content: title || today() + ' 记录' } }] }, '日期': { date: { start: today() } }, '类型': { select: { name: type || '每日记录' } }, '内容': { rich_text: [{ text: { content: content || '' } }] }, '标签': { multi_select: (tags || '').split(',').filter(Boolean).map(t => ({ name: t.trim() })) }, '状态': { select: { name: status || '待同步' } } } }); ``` ```javascript const result = await notion('POST', '/v1/data_sources/' + DS_ID + '/query', { sorts: [{ property: '日期', direction: 'descending' }], pag ...[truncated 2080 chars]- Remediation
View remediation