T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:25- Finding
Privileged Feishu Scheduling APIs Lack Caller Authentication and Authorization
- Content
View full analysis
{ const { userIds, startTimeIso, endTimeIso, durationMinutes } = req.body; // 参数验证 if (!userIds || !Array.isArray(userIds) || userIds.length === 0) { return res.status(400).json({ error: 'userIds 必须是非空数组' }); } if (!startTimeIso || !endTimeIso || !durationMinutes) { return res.status(400).json({ error: '缺少 startTimeIso / endTimeIso / durationMinutes' }); } if (typeof durationMinutes !== 'number' || durationMinutes <= 0) { return res.status(400).json({ error: 'durationMinutes 必须是正整数' }); } try { const timeOptions = await feishu.getCommonFreeTime( userIds, startTimeIso, endTimeIso, durationMinutes ); res.json({ success: true, message: timeOptions.length > 0 ? '找到了以下空闲时段' : '在给定时间内所有人无符合要求的共同空闲时段', data: { options: timeOptions } }); } catch (error) { console.error('[API Error] calc-free-time:', error); res.status(500).json({ error: error.message }); } }); ``` ```js app.post('/api/claw/dispatch-cards', async (req, res) => { const { meetingTopic, userIds, timeSlots, agentMessage } = req.body; if (!meetingTopic || typeof meetingTopic !== 'string') { return res.status(400).json({ error: 'meetingTopic 不能为空' }); } if (!userIds || !Array.isArray(userIds) || userIds.length === 0) { return res.status(400).json({ error: 'userIds 必须是非空数组' }); } if (!timeSlots || !Array.isArray(timeSlots) || timeSlots.length === 0) { return res.status(400).json({ error: 'timeSlots 必须是非空数组' }); } if (!agentMessage || typeof agentMessage !== 'string') { return res.status(400).json({ error: 'agentMessage 不能为空' }); } try { const sessionId = 'ses_' + c ...[truncated 3008 chars]- Remediation
View remediation