T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_shopee_discount_common.py:18- Finding
Credentials can be transmitted to an attacker-controlled gateway
- Content
View full analysis
str: """ Get the API key configured in an environment variable. """ key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print( "API Key not configured", file=sys.stderr, ) sys.exit(1) return key def call_api(endpoint: str, params: dict) -> dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) except HTTPError as e: body = e.read().decode("utf-8") if e.fp else "" return {"error": f"HTTP {e.code}: {e.reason}", "details": body} except URLError as e: return {"error": f"Connection failed: {e.reason}"} ``` ### Technical Analysis The destination receiving the LinkFox API key is selected from environment variables without validating the URL scheme or hostname. T ...[truncated 1662 chars]- Remediation
View remediation
str: parsed = urlparse(raw_url) if parsed.scheme != "https" or parsed.hostname not in ALLOWED_HOSTS: raise RuntimeError("Untrusted LinkFox gateway URL") return raw_url.rstrip("/") ``` 2. Do not support custom credential-bearing endpoints in normal production mode. 3. If custom endpoints are required for development, require an explicit development flag and display a clear warning before sending any credential. 4. Resolve and validate the destination immediately before each request so redirects or altered endpoints cannot bypass validation. 5. Disable automatic redirects to different origins, or remove the authorization header whenever the origin changes. 6. Add automated tests covering HTTP URLs, user-info URLs, unexpected ports, subdomain confusion, and redirect-based credential leakage. 7. Rotate any API key that may have been used while untrusted gateway environment variables were present. ]]>