T09 · Insecure Skill Coding Practices
Error
- Location
- src/olaxbt_nexus_data/__init__.py:82
- Finding
- JWT Disclosure Through Unrestricted API Base URL Overrides<![CDATA[ ## Vulnerability Details **File Location**: `src/olaxbt_nexus_data/__init__.py:82-83`; `src/olaxbt_nexus_data/core/client.py:127-149`; `src/olaxbt_nexus_data/core/auth.py:440-453` **Vulnerability Type**: Credential disclosure through unrestricted authenticated request destinations **Risk Level**: High ### Vulnerable Code ```python # src/olaxbt_nexus_data/__init__.py:82-83 self.auth_url = auth_url or os.getenv( "NEXUS_AUTH_URL", "https://api.olaxbt.xyz/api", ) self.data_url = data_url or os.getenv( "NEXUS_DATA_URL", "https://api-data.olaxbt.xyz/api/v1", ) ``` ```python # src/olaxbt_nexus_data/core/client.py:127-149 # Build URL url = f"{self.base_url}/{endpoint.lstrip('/')}" # Prepare headers request_headers = { "Content-Type": "application/json", "User-Agent": f"OlaXBT-Nexus-Client/{self.auth.wallet_address[:10]}...", "X-Request-ID": generate_request_id(), } if require_auth: try: auth_headers = self.auth.get_auth_headers() request_headers.update(auth_headers) except AuthenticationError as e: logger.error(f"Authentication failed: {str(e)}") raise if headers: request_headers.update(headers) ``` ```python # src/olaxbt_nexus_data/core/auth.py:440-453 def get_auth_headers(self) -> Dict[str, str]: return { "Authorization": f"Bearer {self._jwt}", "X-Request-ID": generate_request_id(), "X-Wallet-Address": self.wallet_address, } def get_credits_balance(self) -> Dict[str, Any]: endpoint = f"{self.auth_url}/credits/balance" try: headers = self.get_auth_headers() response = requests.get( endpoint, headers=headers, timeout=self.security_config.timeout, ) ``` ### Technical Analysis The client accepts `auth_url` and `data_url` from constructor arguments or environment variables without validating their schemes or hosts. The request layer then unconditionally attaches the wallet-linked JWT ...[truncated 2289 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce HTTPS for every authenticated endpoint: ```python from urllib.parse import urlparse def validate_api_url(url: str, allowed_hosts: set[str]) -> str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError("Authenticated API URLs must use HTTPS") if parsed.hostname not in allowed_hosts: raise ValueError("API host is not permitted") if parsed.username or parsed.password: raise ValueError("Credentials in API URLs are prohibited") return url.rstrip("/") ``` 2. Allowlist the documented service hosts: - `api.olaxbt.xyz` for authentication requests. - `api-data.olaxbt.xyz` for data requests. 3. If custom endpoints are required for testing, require an explicit development-only option such as `allow_unsafe_custom_origin=False`. Do not enable it through an implicitly trusted environment variable in production. 4. Bind credentials to their intended origin. Before adding `Authorization`, verify that the destination has the expected HTTPS scheme, hostname, and port. 5. Disable credential forwarding during redirects, or reject cross-origin redirects entirely. This protection should be tested explicitly because HTTP libraries may follow redirects. 6. Add automated tests confirming that: - HTTP URLs are rejected. - Unknown hosts are rejected. - Cross-origin redirects do not receive the JWT. - Official HTTPS endpoints continue to work. 7. Update the documentation so that any supported custom endpoint behavior and associated trust requirements are stated accurately. ]]>