T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth_soundcloud.sh:45- Finding
OAuth State Is Generated but Never Validated
- Content
View full analysis
/dev/null 2>&1; then STATE=$(openssl rand -hex 12 2>/dev/null || echo "sc$(date +%s)") else STATE="sc$(date +%s)$$" fi AUTH_URL="${AUTH_ENDPOINT}?client_id=${SOUNDCLOUD_CLIENT_ID}&redirect_uri=${REDIRECT_URI}&response_type=code&scope=${SCOPES}&state=${STATE}" ``` The callback extracts the returned state but does not validate it: ```python if parsed.path == '/callback': code = params.get('code', [None])[0] state_val = params.get('state', [None])[0] error = params.get('error', [None])[0] self.send_response(200) self.send_header('Content-type', 'text/html; charset=utf-8') self.end_headers() if error: self.wfile.write(f'''Authorization Failed
Error: {error}
You can close this window.
'''.encode()) print(f'ERROR:{error}', flush=True) elif code: self.wfile.write(f'''✓ Authorization Successful!
You can close this window and return to your terminal.
'''.encode()) print(f'CODE:{code}', flush=True) if state_val: print(f'STATE:{state_val}', flush=True) ``` The script instead accepts an independently pasted code and exchanges it without checking state: ```bash echo -e "${YELLOW}Or, paste the authorization code here:${NC}" echo -n "> " read -r AUTH_CODE kill $SERVER_PID 2>/dev/null || true if [ -z "$AUTH_CODE" ]; then ech ...[truncated 2187 chars]- Remediation
View remediation