T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/_logistics_api_runner.py:258- Finding
Generic ERP proxy exceeds the Skill's declared read-only scope
- Content
View full analysis
None: normalized = path.lstrip("/").replace("\\", "/") if ".." in normalized or "//" in normalized: print(f"Error: invalid path {path!r}", file=sys.stderr) sys.exit(1) if not any( normalized == prefix or normalized.startswith(prefix + "/") for prefix in ALLOWED_PATH_PREFIXES ): print( f"Error: path must start with one of {ALLOWED_PATH_PREFIXES}, got {path!r}", file=sys.stderr, ) sys.exit(1) ``` ```python # scripts/_logistics_api_runner.py:258-308 def run_logistics_proxy(params: dict, caller: str = "logistics_proxy.py") -> dict: """Generic proxy: path + method + openId (+ optional shop_cipher).""" if not params.get("skipDepCheck"): ensure_auth_skill_available(caller) path = params.get("path") method = params.get("method") if not path or not method: print("Missing required fields: path, method", file=sys.stderr) sys.exit(1) open_id = require_open_id(params) shop_cipher = None needs_cipher = str(path).lstrip("/").startswith("logistics/") if needs_cipher: shop_cipher = resolve_shop_cipher(params, open_id) query_string = params.get("queryString") if shop_cipher: pairs = dict(parse_qsl(str(query_string or "").lstrip("?"), keep_blank_values=True)) pairs["shop_cipher"] = shop_cipher query_string = urlencode(pair ...[truncated 3981 chars]- Remediation
View remediation