T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/okki-api.js:11- Finding
Unvalidated API Base URL Can Exfiltrate API Keys and Sensitive Business Data
- Content
View full analysis
= 300) { const error = new Error(formatApiError(response.statusCode, body)); error.statusCode = response.statusCode; error.body = body; throw error; } return { statusCode: response.statusCode, body }; } function request(method, urlString, headers, payload) { return new Promise((resolve, reject) => { const url = new URL(urlString); const transport = url.protocol === 'http:' ? http : https; const body = payload === undefined ? null : JSON.stringify(payload); const requestHeaders = Object.assign({}, headers); if (body !== null) { requestHeaders['Content-Length'] = Buffer.byteLength(body); } const req = transport.request({ method, hostname: url.hostname, port: url.port || (url.protocol === 'http:' ? 80 : 443), path: `${url.pathname}${url.search}`, headers: requestHeaders }, (res) => { ``` ### Technical Analysis `OKKIGO_BASE_URL` is accepted without validating its protocol, hostname, port, or origin. The code then attaches the resolved API key through the `Authorization: ApiKey ...` header and sends the request to the resulting URL. The implementation explicitly permits both HTTP and HTTPS. Consequently, an inherited or manipulated environment variable can redirect authenticated requests to an arbitrary host or expose them in plainte ...[truncated 1786 chars]- Remediation
View remediation