T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dm-watcher.js:144- Finding
Instagram DM content is transmitted to Discord without requiring the documented notification mode
- Content
View full analysis
d.username).join(', '); const msgPreview = dmDetails.map(d => { const lastMsg = d.messages?.[d.messages.length - 1]; return `${d.username}: "${(lastMsg?.text || '').substring(0, 50)}"`; }).join('\n'); // 1) DM 채널 열기 const createDM = (token, userId) => new Promise((resolve, reject) => { const body = JSON.stringify({ recipient_id: userId }); const req = https.request({ hostname: 'discord.com', path: '/api/v10/users/@me/channels', method: 'POST', headers: { 'Authorization': `Bot ${token}`, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } }, (res) => { let d = ''; res.on('data', c => d += c); res.on('end', () => { try { resolve(JSON.parse(d)); } catch { reject(d); } }); }); req.on('error', reject); req.write(body); req.end(); }); // 2) 메시지 전송 const sendMsg = (token, channelId, content) => new Promise((resolve, reject) => { const body = JSON.stringify({ content }); const req = https.request({ hostname: 'discord.com', path: `/api/v10/channels/${channelId}/messages`, method: 'POST', headers: { 'Authorization': `Bot ${token}`, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } }, (res) => { let d = ''; res.on('data', c => d += c); res.on('end', () => { try { resolve(JSON.parse(d)); } catch { reject(d); } }); }); req.on('error', reject) ...[truncated 2543 chars]- Remediation
View remediation