T09 · Insecure Skill Coding Practices
Error
- Location
src/olaxbt_nexus_data/__init__.py:82- Finding
JWT Disclosure Through Unrestricted API Base URL Overrides
- Content
View full analysis
Dict[str, str]: return { "Authorization": f"Bearer {self._jwt}", "X-Request-ID": generate_request_id(), "X-Wallet-Address": self.wallet_address, } def get_credits_balance(self) -> Dict[str, Any]: endpoint = f"{self.auth_url}/credits/balance" try: headers = self.get_auth_headers() response = requests.get( endpoint, headers=headers, timeout=self.security_config.timeout, ) ``` ### Technical Analysis The client accepts `auth_url` and `data_url` from constructor arguments or environment variables without validating their schemes or hosts. The request layer then unconditionally attaches the wallet-linked JWT ...[truncated 2289 chars]- Remediation
View remediation
str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError("Authenticated API URLs must use HTTPS") if parsed.hostname not in allowed_hosts: raise ValueError("API host is not permitted") if parsed.username or parsed.password: raise ValueError("Credentials in API URLs are prohibited") return url.rstrip("/") ``` 2. Allowlist the documented service hosts: - `api.olaxbt.xyz` for authentication requests. - `api-data.olaxbt.xyz` for data requests. 3. If custom endpoints are required for testing, require an explicit development-only option such as `allow_unsafe_custom_origin=False`. Do not enable it through an implicitly trusted environment variable in production. 4. Bind credentials to their intended origin. Before adding `Authorization`, verify that the destination has the expected HTTPS scheme, hostname, and port. 5. Disable credential forwarding during redirects, or reject cross-origin redirects entirely. This protection should be tested explicitly because HTTP libraries may follow redirects. 6. Add automated tests confirming that: - HTTP URLs are rejected. - Unknown hosts are rejected. - Cross-origin redirects do not receive the JWT. - Official HTTPS endpoints continue to work. 7. Update the documentation so that any supported custom endpoint behavior and associated trust requirements are stated accurately. ]]>