T09 · Insecure Skill Coding Practices
- Location
scripts/youtube_upload.py:53- Finding
The privacy option is ignored and all videos are uploaded publicly
- Content
View full analysis
Vulnerability Details
File Location:
scripts/youtube_upload.py:53-65,scripts/youtube_upload.py:88, andscripts/youtube_upload.py:98
Vulnerability Type: Privacy-control failure caused by an ignored security parameter
Risk Level: HighVulnerable Code
python def upload_video(youtube, file_path, title, description, tags=None, category="22"): body = { "snippet": { "title": title, "description": description, "tags": tags or [], "categoryId": category, }, "status": { "privacyStatus": "public", "selfDeclaredMadeForKids": False, }, }python parser.add_argument( "--privacy", default="public", choices=["public", "private", "unlisted"] )python video_id = upload_video( youtube, args.file, args.title, args.description, tags )Technical Analysis
The command-line interface accepts
public,private, andunlistedas valid privacy settings. However,args.privacyis never passed toupload_video(). Instead, the YouTube API request unconditionally assigns the literal valuepublictostatus.privacyStatus.This creates a fail-open privacy control. The script appears to provide a confidentiality option, and the documentation states that
--privacychanges upload visibility, but the effective behavior is always public. No warning or error informs the operator that the requested privacy setting was discarded.Attack Path
- An operator prepares confidential, embargoed, internal, or pre-release video content.
- The operator invokes the script with
--privacy privateor--privacy unlisted. - The argument parser accepts the requested value, making the invocation appear valid.
- The main function does not pass
args.privacytoupload_video(). - The upload request uses the hard-coded value `"privacySt ...[truncated 880 chars]
- Remediation
View remediation
Remediation Suggestions
Add an explicit privacy parameter to
upload_video()and pass the validated command-line value into the API request:python def upload_video( youtube, file_path, title, description, tags=None, category="22", privacy="private", ): allowed_privacy = {"public", "private", "unlisted"} if privacy not in allowed_privacy: raise ValueError(f"Unsupported privacy setting: {privacy}") body = { "snippet": { "title": title, "description": description, "tags": tags or [], "categoryId": category, }, "status": { "privacyStatus": privacy, "selfDeclaredMadeForKids": False, }, }Pass the value from
main():python video_id = upload_video( youtube, args.file, args.title, args.description, tags, privacy=args.privacy, )Use
privateas the default if a fail-safe publication policy is appropriate. Add automated tests that inspect the generated API body for all three supported values. The script should also print the selected visibility before initiating the upload and require explicit confirmation for public publication in interactive use.