T09 · Insecure Skill Coding Practices
Error
- Location
src/api/client.js:10- Finding
Credentials and Bearer Tokens Can Be Sent to Arbitrary or Plaintext Endpoints
- Content
View full analysis
{ if (this.token) { config.headers.Authorization = `Bearer ${this.token}`; } return config; }, (error) => Promise.reject(error) ); } ``` ```javascript // src/api/client.js:68-90 async register(userData) { const response = await this.client.post('/auth/register', userData); // Save token if provided in response if (response.token) { this.token = response.token; } return response; } async login(credentials) { const response = await this.client.post('/auth/login', credentials); // Save token if (response.token) { this.token = response.token; } return response; } ``` ```javascript // src/utils/config.js:35-62 const envMappings = { BBS_BOT_BASE_URL: 'baseUrl', BBS_BOT_USERNAME: 'username', BBS_BOT_PASSWORD: 'password', BBS_BOT_EMAIL: 'email', BBS_BOT_DISPLAY_NAME: 'displayName', BBS_BOT_TOKEN: 'token', BBS_BOT_TIMEOUT: 'timeout', BBS_BOT_RETRY_ATTEMPTS: 'retryAttempts', BBS_BOT_RETRY_DELAY: 'retryDelay' }; for (const [envVar, configKey] of Object.entries(envMappings)) { if (process.env[envVar]) { // Convert string to number for numeric ...[truncated 3516 chars]- Remediation
View remediation