T09 · Insecure Skill Coding Practices
Warning
- Location
references/webhooks.md:35- Finding
Webhook Examples Process Unauthenticated, Attacker-Controlled Events
- Content
View full analysis
{ // Acknowledge receipt immediately res.status(200).send("OK"); // Process event asynchronously processWebhookEvent(req.body).catch(console.error); }); async function processWebhookEvent(event: HeyGenWebhookEvent) { console.log(`Received event: ${event.event_type}`); switch (event.event_type) { case "avatar_video.success": await handleVideoSuccess(event); break; case "avatar_video.fail": await handleVideoFailure(event); break; case "video_translate.success": await handleTranslationSuccess(event); break; default: console.log(`Unknown event type: ${event.event_type}`); } } app.listen(3000, () => { console.log("Webhook server running on port 3000"); }); ``` ```python @app.route("/webhook/heygen", methods=["POST"]) def heygen_webhook(): event = request.json # Acknowledge immediately response = jsonify({"status": "received"}) # Process asynchronously thread = threading.Thread( target=process_webhook_event, args=(event,) ) thread.start() return response, 200 def process_webhook_event(event): event_type = event.get("event_type") print(f"Received event: {event_type}") if event_type == "avatar_video.success": handle_video_success(event) elif event_type == "avatar_video.fail": handle_video_failure(event) elif event_type == "video_translate.success": handle_translation_success(event) ``` ### Technical Analysis The primary Express.js and Flask examples accept arbitrary POST requests and pass their bodies directly to business-logic handlers. Neither implementation verifies a cryptographic si ...[truncated 2262 chars]- Remediation
View remediation