T09 · Insecure Skill Coding Practices
Warning
- Location
src/server.ts:183- Finding
Unauthenticated Loopback API Permits Unauthorized Local Subtitle File Disclosure
- Content
View full analysis
{ const entry: EntrySnapshot = { id: asString(raw.id, String(index + 1).padStart(6, "0")), order: asNumber(raw.order, index + 1), sourceText: asString(raw.source_text), status: "pending", kind: raw.kind === "ass" ? "ass" : "srt", }; if (typeof raw.start_ms === "number") { entry.startMs = raw.start_ms; } if (typeof raw.end_ms === "number") { entry.endMs = raw.end_ms; } if (raw.degradation === "karaoke") { entry.degradation = "karaoke"; } return entry; }); ``` ### Technical Analysis The visualizer server binds to `127.0.0.1`, which limits direct network exposure but does not authenticate callers. The API does not require a bearer token, session credential, capability secret, or other proof that the caller is the authorized bridge. `POST /api/tasks` accepts a caller-controlled `filePath`. The task manager resolves that path and permits any regular file with an accepted subtitle extension. It ...[truncated 2341 chars]- Remediation
View remediation