T09 · Insecure Skill Coding Practices
Error
- Location
fetcher.py:8- Finding
Home Assistant Bearer Token Transmitted over Plaintext HTTP
- Content
View full analysis
dict[str, str]: return { "Authorization": f"Bearer {token}", "Content-Type": "application/json", } def fetch_states(ha_url: str, token: str) -> list[dict]: """Fetch all entity states from Home Assistant.""" url = f"{ha_url.rstrip('/')}/api/states" try: resp = httpx.get(url, headers=_headers(token), timeout=10.0) resp.raise_for_status() ``` The same authenticated request pattern is used for the area and device registries: ```python def fetch_area_registry(ha_url: str, token: str) -> list[dict]: """Fetch the area registry from Home Assistant.""" url = f"{ha_url.rstrip('/')}/api/config/area_registry" try: resp = httpx.get(url, headers=_headers(token), timeout=10.0) resp.raise_for_status() ``` ```python def fetch_entity_area_map(ha_url: str, token: str) -> dict[str, str]: """Build a mapping of entity_id to area name from HA device/area registries.""" url = f"{ha_url.rstrip('/')}/api/config/device_registry" try: resp = httpx.get(url, headers=_headers(token), timeout=10.0) resp.raise_for_status() ``` ### Technical Analysis The Skill sends a long-lived Home Assistant access token in an HTTP `Authorization` header. The shipped configuration and documentation use a plaintext `http://` URL, and the code does not validate the URL scheme or require transport encryption. When HTTP is used, both the bearer token and returned Home Assistant data are transmitted without confidentiality or server au ...[truncated 1829 chars]- Remediation
View remediation