T09 · Insecure Skill Coding Practices
Warning
- Location
bark_push/config_manager.py:205- Finding
Unrestricted Bark Endpoint Allows Plaintext Disclosure of Device Credentials and Notification Data
- Content
View full analysis
None: self._base_url = base_url.rstrip("/") def push_json( self, payload: dict[str, Any], timeout_s: float = 10.0, ) -> BarkResponse: url = self._resolve_url(payload) body_bytes = json.dumps( payload, ensure_ascii=False, ).encode("utf-8") req = Request(url, data=body_bytes, method="POST") req.add_header("Content-Type", "application/json; charset=utf-8") try: with urlopen(req, timeout=timeout_s) as resp: ``` ### Technical Analysis The `default_push_url` configuration value is only checked for being a string. The implementation does not parse or validate its scheme, hostname, port, embedded credentials, or destination. The configured value is passed directly to `BarkClient`. During a push, the client adds the recipient's Bark `device_key` to the JSON payload and transmits the payload to that endpoint. The payload can also contain notification content, clipboard data, actions, and ciphertext-related parameters. Consequently, a config ...[truncated 2188 chars]- Remediation
View remediation