T09 · Insecure Skill Coding Practices
Error
- Location
scripts/onboarding.py:60- Finding
Credential Disclosure Through Unrestricted API Endpoint Overrides
- Content
View full analysis
Vulnerability Details
File Location:
scripts/onboarding.py, lines 60-78, 173-186, 213-221, and 397-451
Vulnerability Type: Unvalidated credential transmission destination
Risk Level: HighVulnerable Code
python def _env_base(name: str, default: str, *fallbacks: str) -> str: for n in (name, *fallbacks): v = os.environ.get(n) if v: return v.rstrip("/") return default.rstrip("/") def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env_base("LINKFOX_AGENT_USER_API_URL", "https://agent-api.linkfox.com")python def _http_post(url: str, body: dict, headers: dict, timeout: int = 30) -> dict: """通用 requests POST，返回 JSON 或 {_error, _body}。""" try: _require_requests() except RuntimeError as e: return {"_error": str(e)} try: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout) return r.json() except Exception as e: body_text = "" resp = getattr(e, "response", None) if resp is not None: try: body_text = resp.text[:500] except Exception: pass return {"_error": str(e), "_body": body_text}python def _fetch_user_info_v3(access_token: str, user_id: str) -> dict: """从 userInfo 拿 group_id / member_id。""" resp = _http_post(f"{_login_base()}/linkFoxApp/api/userCenter/userInfo", {}, _headers("agent-linkfox-web", "agent.linkfox.com", access_token=access_token, user_id=user_id))python def _get_or_generate_api_token(access_token: str, user_id: str, group_id: str) -> d ...[truncated 2632 chars]- Remediation
View remediation
Remediation Suggestions
- Remove production support for arbitrary authentication endpoint overrides.
- If overrides are required for development, require an explicit development-mode flag and reject them by default.
- Enforce HTTPS and validate destinations against an exact allowlist of approved LinkFox hostnames.
- Resolve and validate the effective hostname before attaching any authorization header or sensitive request body.
- Disable redirects for credential-bearing requests, or validate every redirect target before forwarding credentials.
- Separate public login requests from authenticated requests so that credentials cannot accidentally be attached to an untrusted service.
- Avoid returning raw server response bodies when they may contain tokens or private account information.
- Add automated tests confirming that HTTP URLs, unapproved hosts, user-info subdomains, and cross-origin redirects are rejected.