T09 · Insecure Skill Coding Practices
Error
- Location
scripts/files_binary.py:47- Finding
Basic Authentication Credentials Can Be Sent Without TLS or Exposed Through Unsafe Redirects
- Content
View full analysis
tuple[str, str, str]: url = os.environ.get("NEXTCLOUD_URL", "").rstrip("/") user = os.environ.get("NEXTCLOUD_USER", "") token = os.environ.get("NEXTCLOUD_TOKEN", "") if not (url and user and token): print( "ERROR: NEXTCLOUD_URL, NEXTCLOUD_USER, and NEXTCLOUD_TOKEN must be set.", file=sys.stderr, ) sys.exit(1) return url, user, token def _auth(user: str, token: str) -> dict: creds = base64.b64encode(f"{user}:{token}".encode()).decode() return {"Authorization": f"Basic {creds}"} def cmd_download(nc_path: str, local_path: str) -> None: url, user, token = _config() dav_url = _dav_url(nc_path, url, user) req = urllib.request.Request(dav_url, headers=_auth(user, token)) try: with urllib.request.urlopen(req) as resp: data = resp.read() ``` The JavaScript client has the same absence of URL and TLS validation: ```javascript var CONFIG = { url: process.env.NEXTCLOUD_URL, user: process.env.NEXTCLOUD_USER, token: process.env.NEXTCLOUD_TOKEN, timeZone: process.env.NEXTCLOUD_TIMEZONE || process.env.TZ || "UTC" }; if (!CONFIG.url || !CONFIG.user || !CONFIG.token) { console.error(JSON.stringify({ status: "error", message: "Missing configuration. Set NEXTCLOUD_URL, NEXTCLOUD_USER, and NEXTCLOUD_TOKEN." })); process.exit(1); } var AUTH_HEADER = "Basic " + Buffer2.from(`${CONFIG.user}:${CONFIG.token}`).toString("base64"); async function request(endpoint, options = {}) { const url = `${CONFIG.url}${endpoint}`; const headers = { "Authorization": AUTH_HEADER, "User-Agent": "OpenClaw-Nextcloud-Skill", ...options.headers }; try { ...[truncated 2716 chars]- Remediation
View remediation