T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/feishu_utils.py:12
- Finding
- TLS Certificate Verification Disabled for Credential-Bearing Feishu API Requests## Vulnerability Details **File Locations**: - `scripts/feishu_utils.py:12-29` - `SKILL.md:41-60` - `references/oauth.md:41-54` - `references/drive.md:126-127` **Vulnerability Type**: CWE-295 — Improper Certificate Validation **Risk Level**: High ### Vulnerable Code `scripts/feishu_utils.py:12-29`: ```python def get_access_token(app_id, app_secret): url = 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' data = json.dumps({'app_id': app_id, 'app_secret': app_secret}).encode() req = urllib.request.Request(url, data=data, method='POST') req.add_header('Content-Type', 'application/json') ctx = ssl._create_unverified_context() with urllib.request.urlopen(req, context=ctx, timeout=10) as r: resp = json.loads(r.read()) return resp.get('tenant_access_token', '') def call_api(url, method, token, payload=None): ctx = ssl._create_unverified_context() data = json.dumps(payload, ensure_ascii=False).encode() if payload else None req = urllib.request.Request(url, data=data, method=method) req.add_header('Authorization', f'Bearer {token}') req.add_header('Content-Type', 'application/json') with urllib.request.urlopen(req, context=ctx, timeout=30) as r: return json.loads(r.read()) ``` `SKILL.md:41-60`: ```python def get_app_access_token(app_id, app_secret): url = 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' data = json.dumps({'app_id': app_id, 'app_secret': app_secret}).encode() req = urllib.request.Request(url, data=data, method='POST') req.add_header('Content-Type', 'application/json') ctx = ssl._create_unverified_context() with urllib.request.urlopen(req, context=ctx, timeout=10) as r: return json.loads(r.read()).get('tenant_access_token') def call_feishu_api(url, method, token, payload=None): ctx = ssl._create_unverified_context() da ...[truncated 4573 chars]
- Remediation
- ## Remediation Suggestions 1. Remove every use of `ssl._create_unverified_context()` from executable code and documentation. 2. Use Python's default verified TLS behavior: ```python with urllib.request.urlopen(req, timeout=10) as response: result = json.loads(response.read()) ``` 3. If an explicit context is required, create a verified default context: ```python ctx = ssl.create_default_context() with urllib.request.urlopen(req, context=ctx, timeout=10) as response: result = json.loads(response.read()) ``` 4. Do not add a production configuration option that permits certificate verification to be disabled. 5. Restrict API URLs to the expected HTTPS origin, such as `https://open.feishu.cn`, before attaching bearer tokens. This is particularly important for the generic `call_api` function, which accepts a caller-supplied URL. 6. Validate API responses and fail closed on TLS, HTTP, JSON, and Feishu API errors. 7. Update every example in `SKILL.md`, `references/oauth.md`, and `references/drive.md` so users do not copy insecure TLS handling into production code. 8. Rotate the Feishu application secret and revoke active access and refresh tokens if the affected code has been used over an untrusted or intercepted network. 9. Review application scopes and retain only those required for the intended operation, especially Drive write access, permission administration, and Bitable deletion.