T09 · Insecure Skill Coding Practices
Error
- Location
bridge.mjs:396- Finding
Unauthenticated Cross-Origin Wallet Bridge Permits Workflow Interference and Sensitive Data Disclosure
- Content
View full analysis
{ log('>>>', `Bridge server listening on ${this.base}`); resolve(); }); ``` ```js _handle(req, res) { res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; } const url = new URL(req.url, this.base); if (url.pathname === '/' && req.method === 'GET') { res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }); res.end(BRIDGE_HTML); return; } if (url.pathname === '/next-action' && req.method === 'GET') { if (this._actionQueue.length > 0) { const action = this._actionQueue.shift(); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(action)); } else { let settled = false; const waiter = (action) => { if (settled) return; settled = true; res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(action)); }; this._actionWaiters.push(waiter); req.on('close', () => { if (!settled) { settled = true; const idx = this._actionWaiters.indexOf(waiter); if (idx !== -1) this._actionWaiters.splice(idx, 1); } }); setTimeout(() => { if (!settled) { settled = true; const idx = this._actionWaiters.indexOf(waiter); if (idx !== -1) this._actionWaiters.splice(idx, 1); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ action: 'ping' })); } }, 30000); } return; ...[truncated 3703 chars]- Remediation
View remediation