T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_token_configs_plus.py:276- Finding
Access Tokens Can Be Disclosed to Arbitrary Probe Endpoints
- Content
View full analysis
Dict[str, Any]: out = {'online_checked': False, 'online_valid': None, 'probe': probe_url, 'probe_detail': None, 'probe_json': None} if requests is None: out['probe_detail'] = 'requests_not_installed' return out access_token = data.get('access_token') if not isinstance(access_token, str) or not access_token: out['probe_detail'] = 'no_access_token' return out headers = {'Authorization': f'Bearer {access_token}'} try: out['online_checked'] = True r = requests.get(probe_url, headers=headers, timeout=timeout) out['status_code'] = r.status_code out['probe_detail'] = r.text[:5000] try: out['probe_json'] = r.json() except Exception: out['probe_json'] = None out['online_valid'] = 200 <= r.status_code < 300 except Exception as e: out['online_checked'] = True out['online_valid'] = False out['probe_detail'] = str(e) return out ``` The destination is supplied through the command-line option: ```python ap.add_argument('--probe-url', default=DEFAULT_PROBE_URL) ... if args.probe: rep.update(online_probe(data, args.probe_url)) ``` ### Technical Analysis When `--probe` is enabled, the enhanced script reads the complete `access_token` from each candidate configuration file and places it in an HTTP `Authorization` header. The destination comes directly from the unrestricted `--probe-url` argument. The implementation does not: - Require HTTPS. - Restrict probing to recognized provider domains. - Confirm disc ...[truncated 1799 chars]- Remediation
View remediation