T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aliyun_domain.py:730- Finding
Sensitive Domain Mutations Can Execute Without User Confirmation
- Content
View full analysis
Dict: request = SaveSingleTaskForApprovingTransferOutRequest.SaveSingleTaskForApprovingTransferOutRequest() request.set_DomainName(domain_name) response = self._do_request(request) return response ``` Representative automatic-renewal implementation at lines 814-831: ```python def setup_auto_renew( self, domain_name: str, auto_renew: bool, duration: int = 1 ) -> Dict: request = SetupDomainAutoRenewRequest.SetupDomainAutoRenewRequest() request.set_DomainName(domain_name) request.set_AutoRenew(auto_renew) request.set_Duration(duration) response = self._do_request(request) return response ``` Representative DNS-host deletion implementation at lines 1047-1062: ```python def delete_dns_host(self, domain_name: str, host_name: str) -> Dict: request = SaveSingleTaskForDeletingDnsHostRequest.SaveSingleTaskForDeletingDnsHostRequest() request.set_DomainName(domain_name) request.set_HostName(host_name) response = self._do_request(request) return response ``` ### Technical Analysis The Skill declares that financial and sensitive domain-management operations require explicit user confirmation. Registration, renewal, and DNS-server modification partially enforce this policy through a `confirmed: bool = False` parameter and a rejection when confirmation is absent. The same control is missing from multiple other sensitive methods, including: - Transfer-prohibition lock changes at lines 730-747 - Transfer authorization-code requests at lines 766-779 - Transfer-out approval and cancellation at lines 782-811 - Automatic-renewa ...[truncated 2145 chars]- Remediation
View remediation