T09 · Insecure Skill Coding Practices
Warning
- Location
- lib.sh:277
- Finding
- Unredacted Diagnostic Data Can Be Sent to a User-Configured Healthcheck Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `lib.sh:277-290`; related callers in `bin/backup.sh:75-79`, `bin/backup.sh:99-103`, and `bin/backup.sh:137-141` **Vulnerability Type**: Unredacted transmission of diagnostic information **Risk Level**: Medium ### Complete Code Snippet ```bash hc_send() { [[ "$PRIVACY_LOCAL_ONLY" == "true" ]] && return 0 [[ "$HC_ENABLED" != "true" ]] && return 0 [[ -z "$HC_URL" ]] && return 0 [[ "$HC_URL" == "null" ]] && return 0 local state="${1:-}" local body="${2:-}" local url="${HC_URL%/}${state}" [[ "$PRIVACY_SEND_ERROR_DETAILS" != "true" ]] && body="" if [[ -n "$body" ]]; then curl -fsS -m 10 --retry 2 --data-raw "$body" "$url" >/dev/null 2>&1 \ || log_warn "Healthcheck ping failed for state '${state:-success}'" else curl -fsS -m 10 --retry 2 "$url" >/dev/null 2>&1 \ || log_warn "Healthcheck ping failed for state '${state:-success}'" fi } ``` Related failure calls include: ```bash if [[ $BACKUP_EXIT -ne 0 ]]; then log_error "restic backup failed (exit $BACKUP_EXIT)" log_error "$BACKUP_OUTPUT" tg_failure "restic backup failed (exit $BACKUP_EXIT):\n\n$BACKUP_OUTPUT" hc_send /fail "restic backup failed (exit $BACKUP_EXIT)" exit 1 fi ``` ```bash if [[ $FORGET_EXIT -ne 0 ]]; then log_error "restic forget failed (exit $FORGET_EXIT)" log_error "$FORGET_OUTPUT" tg_failure "restic forget failed (exit $FORGET_EXIT):\n\n$FORGET_OUTPUT" hc_send /fail "restic forget failed (exit $FORGET_EXIT)" exit 1 fi ``` ```bash if [[ $CHECK_EXIT -ne 0 ]]; then log_error "restic check failed (exit $CHECK_EXIT)" log_error "$CHECK_OUTPUT" tg_failure "restic check failed (exit $CHECK_EXIT):\n\n$CHECK_OUTPUT" hc_send /fail "restic check failed (exit $CHECK_EXIT)" fi ``` ### Technical Analysis When both external healthchecks and `privacy.send_error_details` are enabled, `hc_send` tr ...[truncated 2242 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply the existing redaction function before transmitting any healthcheck body: ```bash if [[ -n "$body" ]]; then body=$(_redact_external_text "$body") body=$(head -c 600 <<< "$body") fi ``` 2. Prefer fixed, non-sensitive status values such as `backup_failed`, `prune_failed`, and `integrity_check_failed` rather than transmitting command output. 3. Introduce a separate, clearly named option such as `privacy.send_healthcheck_diagnostics`, disabled by default, instead of reusing a general error-detail setting. 4. Enforce a strict maximum request-body size and remove control characters before transmission. 5. Document that the healthcheck endpoint receives operational information and may be operated by a third party. 6. Add tests verifying that path-like strings, tokens, passwords, repository URLs, and oversized messages are redacted or rejected in healthcheck requests. ]]>