T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/zoom_api.py:275- Finding
Unvalidated identifiers are interpolated into authenticated Zoom API paths
- Content
View full analysis
Vulnerability Details
File Location:
scripts/zoom_api.py:275-334
Vulnerability Type: Improper validation and encoding of URL path segments
Risk Level: MediumVulnerable Code
python def get_meeting(self, meeting_id: str) -> dict: """ Retrieve meeting details. Args: meeting_id: Zoom meeting ID. Returns: Meeting details. """ response = self._request("GET", f"/meetings/{meeting_id}") return { "meeting_id": str(response.get("id", meeting_id)), "join_url": response.get("join_url", ""), "password": response.get("password", ""), "topic": response.get("topic", ""), "start_time": response.get("start_time", ""), "duration": response.get("duration", 0), "timezone": response.get("timezone", ""), "status": response.get("status", "") } def list_meetings(self, user_id: str = "me") -> list: """ List all meetings for a user. Args: user_id: User ID or 'me' for authenticated user. Returns: List of meeting summaries. """ response = self._request("GET", f"/users/{user_id}/meetings") meetings = response.get("meetings", []) return [ { "meeting_id": str(m.get("id", "")), "topic": m.get("topic", ""), "start_time": m.get("start_time", ""), "duration": m.get("duration", 0), "join_url": m.get("join_url", "") } for m in meetings ] def delete_meeting(self, meeting_id: str) -> dict: """ Delete a Zoom meeting. Args: meeting_id: Zoom meeting ID. Returns: Confirmation response. """ self._request("DELETE", f"/meetings/{meeting_id}") return { "success": True, "meeting_id": meeting ...[truncated 1991 chars]- Remediation
View remediation
Remediation Suggestions
- Validate meeting IDs using Zoom's documented identifier format. If only numeric meeting IDs are supported, enforce a strict expression such as
^[0-9]+$. - Restrict
user_idtomeunless arbitrary user access is explicitly required. Otherwise, validate it against Zoom's documented user identifier format. - Encode every variable URL path segment using
urllib.parse.quote(value, safe="")after validation. - Reject values containing
/,\,?,#, percent-encoded delimiters, control characters, or traversal components. - Construct endpoints through dedicated helper functions rather than general string interpolation.
- Assign only the minimum Zoom OAuth scopes needed to create, read, list, and delete meetings.
- Add tests covering traversal strings, encoded delimiters, query fragments, empty identifiers, oversized identifiers, and malformed Unicode input.
- Validate meeting IDs using Zoom's documented identifier format. If only numeric meeting IDs are supported, enforce a strict expression such as