T09 · Insecure Skill Coding Practices
Error
- Location
scripts/klientenportal.py:156- Finding
Unvalidated Portal URL Can Redirect Credentials to an Attacker-Controlled Origin
- Content
View full analysis
dict: """Load config from config.json or env vars. Env vars (override config.json values): KLIENTENPORTAL_PORTAL_ID, KLIENTENPORTAL_USER_ID, KLIENTENPORTAL_PASSWORD """ cfg: dict = {} if CONFIG_FILE.exists(): cfg = json.loads(CONFIG_FILE.read_text(encoding="utf-8")) _harden_path(CONFIG_FILE) # Env vars override / supplement config.json portal_id = os.environ.get("KLIENTENPORTAL_PORTAL_ID") or cfg.get("portal_id", "") user_id = os.environ.get("KLIENTENPORTAL_USER_ID") or cfg.get("user_id", "") password = os.environ.get("KLIENTENPORTAL_PASSWORD") or cfg.get("password", "") if not portal_id or not user_id or not password: missing = [n for n, v in [("portal_id", portal_id), ("user_id", user_id), ("password", password)] if not v] print(f"ERROR: Missing config: {', '.join(missing)}") print(f"Create {CONFIG_FILE} or set env vars. See SKILL.md for details.") sys.exit(1) cfg["portal_id"] = portal_id cfg["portal_url"] = cfg.get("portal_url") or f"https://klientenportal.at/prod/{portal_id}" cfg["user_id"] = user_id cfg["password"] = password return cfg ``` The resulting URL is used as the authentication origin: ```python def login(page, config: dict) -> bool: """Log in to the portal.""" portal_url = config["portal_url"] # Already logged in? if page.locator("text=Abmelden").count() > 0: print("[login] Session still valid", flush=True) dismiss_modals(page) return True page.goto(f"{portal_url}/account/login", wait_until="networkidle") time.sleep(1) if page.locator("text=Abmelden").count() > 0: print("[login] Alr ...[truncated 2405 chars]- Remediation
View remediation