T09 · Insecure Skill Coding Practices
Warning
- Location
- bin/run.mjs:241
- Finding
- API access token transmitted in the URL query string## Vulnerability Details **File Location**: `bin/run.mjs`, lines 21–29, 109–111, 224–231, and 241–248 **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code The operation declares the access token as a query parameter: ```js { "defaultValue": null, "description": "Access token for this API service.", "enumValues": [], "location": "query", "name": "token", "required": true, "schemaType": "string" }, ``` The supplied token is inserted into the parameter object: ```js const params = parseParams(args.paramsJson); applyDefaults(operation, params); injectToken(operation, params, args.token); validateRequired(operation, params); ``` All declared query parameters, including `token`, are then appended to the request URL: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ```js function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` ### Technical Analysis The helper sends the JustOneAPI access token as part of the URL for an HTTPS GET request. HTTPS protects the URL while it is in transit, but it does not prevent the complete URL from being recorded at endpoints or trusted intermediaries. Reverse proxies, API gateways, server access logs, monitoring agents, browser-like diagnostics, an ...[truncated 1441 chars]
- Remediation
- ## Remediation Suggestions 1. Modify the API integration to send credentials in an HTTP authorization header, preferably using a short-lived bearer token: ```js const requestInit = { headers: { accept: "application/json", authorization: `Bearer ${token}`, }, method: operation.method, }; ``` 2. Remove `token` from the operation's query parameters and ensure it is never added to `URL.searchParams`. 3. If JustOneAPI only supports query-string authentication, request support for header-based authentication. Until then: - Use short-lived and narrowly scoped tokens. - Configure gateways, proxies, servers, and monitoring tools to redact the `token` parameter. - Disable full-URL logging where practical. - Rotate any token suspected of appearing in logs. - Restrict access to retained request and diagnostic logs. 4. Add automated tests asserting that serialized request URLs never contain token values.