T09 · Insecure Skill Coding Practices
Error
- Location
scripts/command.py:48- Finding
OAuth bearer and partner tokens can be transmitted to arbitrary configured endpoints
- Content
View full analysis
Any: headers = { "Accept": "application/json", "Authorization": f"Bearer {token}", } body = None if json_body is not None: body = json.dumps(json_body).encode("utf-8") headers["Content-Type"] = "application/json" req = urllib.request.Request(url=url, method=method, data=body, headers=headers) ctx = None if url.startswith("https://"): ctx = ssl.create_default_context(cafile=ca_cert) if ca_cert else ssl.create_default_context() try: with urllib.request.urlopen(req, context=ctx) as resp: return json.loads(resp.read().decode("utf-8")) ``` The destination is loaded directly from local configuration without scheme or hostname validation: ```python token = auth.get("access_token") audience = cfg.get("audience") or "https://fleet-api.prd.eu.vn.cloud.tesla.com" base_url = cfg.get("base_url") or audience ca_cert = cfg.get("ca_cert") ``` The configured destination is used to retrieve vehicle identifiers and send commands: ```python def fetch_vehicles(base_url: str, token: str, ca_cert: Optional[str] = None) -> List[Dict[str, Any]]: url = f"{base_url.rstrip('/')}/api/1/vehicles" data = http_json("GET", url, token, ca_cert=ca_cert) return data.get("response", []) ``` ```python def send_command( base_url: str, token: s ...[truncated 4001 chars]- Remediation
View remediation