T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/_shared.mjs:108
- Finding
- Process-Wide TLS Certificate Verification Disabled for Authoritative Legal Downloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_shared.mjs:108-114` **Related Locations**: `scripts/fetch.js:49-60`, `scripts/update.js:50-59`, `SKILL.md:38-41,179-185` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```js // ── Apply --insecure flag ────────────────────────────────────────────────────── export function applyInsecure(insecure) { if (insecure) { console.warn("⚠️ --insecure: проверка TLS отключена. Используйте только в доверенной сети."); process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; } } ``` The flag is consumed by the download scripts as follows: ```js const insecure = args["insecure"] === true || args["insecure"] === "true"; if (!htmlFile && !insecure) { console.error([ "Ошибка: для скачивания с adilet.zan.kz укажите --insecure (только в доверенной сети).", "Рекомендуется: скачайте HTML вручную и передайте через --html=./file.html", ].join("\n")); process.exit(1); } applyInsecure(insecure); ``` ### Technical Analysis Setting `NODE_TLS_REJECT_UNAUTHORIZED` to `"0"` disables TLS certificate verification for all HTTPS requests made by that Node.js process. The code then downloads legal documents that are treated as authoritative input by the Skill. The only relevant content-integrity checks are minimum document length in `fetch.js` and minimum article count in `update.js`. These checks establish neither authenticity nor integrity. An attacker can construct forged legal content that satisfies both conditions. The HTTP client also follows redirects under the default Fetch behavior, while the implementation performs no validation of the final response URL. There is no certificate pinning, trusted custom CA configuration, cryptographic signature, or checksum verification. This behavior is particularly sensitive because `update.js` can replace the current tax-code corpus with downloaded content. Although the TLS setting is limited to the script pro ...[truncated 1279 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for globally disabling certificate validation. 2. Add the required Kazakhstan CA certificate explicitly through a narrowly scoped HTTPS agent or `NODE_EXTRA_CA_CERTS`. 3. Keep normal hostname and certificate-chain verification enabled. 4. Reject redirects to hosts other than the approved `adilet.zan.kz` origin, or disable automatic redirects and validate each redirect target. 5. Validate document identifiers against a strict allowlist pattern before constructing the URL. 6. Verify downloaded documents against a trusted digital signature, published checksum, or independently authenticated metadata where available. 7. Preserve the manual HTML-import workflow as the fallback, but clearly require users to confirm the browser origin and certificate status. 8. Perform updates transactionally: validate both language versions first, write temporary files, then atomically replace the current corpus only after all checks pass. 9. Retain backups and provide an integrity manifest so poisoned updates can be detected and rolled back. ]]>