T09 · Insecure Skill Coding Practices
Error
- Location
send.js:161- Finding
Configurable API Origin Can Expose the Bot Bearer Token
- Content
View full analysis
${res.status}`, VERBOSE ? raw : ''); if (!res.ok) throw new Error(`HTTP ${res.status}: ${raw}`); let json = {}; try { json = JSON.parse(raw); } catch { /* empty response means success */ } if (json && json.ret && json.ret !== 0) { throw new Error(`API ret=${json.ret} errmsg=${json.errmsg}`); } if (json && json.errcode && json.errcode !== 0) { throw new Error(`API errcode=${json.errcode} errmsg=${json.errmsg}`); } return json; } ``` The authorization header is constructed with the complete bot credential: ```js Authorization: `Bearer ${token}`, ``` ### Technical Analysis The script obtains `baseUrl` from the local WorkBuddy configuration and uses it as the destination for requests containing the c ...[truncated 1928 chars]- Remediation
View remediation