T09 · Insecure Skill Coding Practices
Warning
- Location
bin/run.mjs:24- Finding
API Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
"}' ``` The operation declares the token as a query parameter: ```javascript { "defaultValue": null, "description": "User authentication token.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" } ``` The token is injected into the request parameters and all query parameters are appended to the URL: ```javascript const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); ``` ```javascript function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` The resulting URL, including the token, is then submitted: ```javascript response = await fetch(url, requestInit); ``` ### Technical Analysis The API token is exposed through two credential-handling mechanisms: 1. Passing the token with `--token` can expose it in process listings, process inspection interfaces, command-execution telemetry, job-runner metadata, or other local monitoring systems. 2. Declaring the token as a query parameter causes it to appear in the complete request URL. Query strings are commonly retained by API gateways, reverse proxies, access logs, monitoring platforms, error reports, ...[truncated 2232 chars]- Remediation
View remediation