T09 · Insecure Skill Coding Practices
Error
- Location
bin/common.js:3- Finding
Configurable API Base URL Breaks the Declared Localhost Trust Boundary
- Content
View full analysis
{ const url = new URL(endpoint, baseUrl); const payload = body === undefined ? undefined : JSON.stringify(body); const options = { hostname: url.hostname, port: url.port || 80, path: `${url.pathname}${url.search}`, method, headers: { 'Content-Type': 'application/json', }, timeout: timeoutMs, }; if (payload) { options.headers['Content-Length'] = Buffer.byteLength(payload); } const req = http.request(options, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { let parsed; try { parsed = JSON.parse(data); } catch (error) { parsed = { raw: data }; } resolve({ statusCode: res.statusCode, ok: res.statusCode >= 200 && res.statusCode < 300, body: parsed, }); }); }); req.on('timeout', () => { req.destroy(); reject(new Error(`Request timeout after ${timeoutMs}ms`)); }); req.on('error', reject); if (payload) { req.write(payload); } req.end(); }); } ``` ### Technical Analysis The Skill declares that it communicates only with the MoreLogin Local API at `http://127.0.0.1:40000`. However, `MORELOGIN_LOCAL_API_URL` can replace that destination with an arbitrary hostname, and `request ...[truncated 1918 chars]- Remediation
View remediation