T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_common.sh:218- Finding
Configurable API base URL can disclose bearer credentials and user content
- Content
View full analysis
"$err_file") || curl_status=$? else http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? fi ``` The diagnostic script uses the same unvalidated destination: ```bash if [[ -n "${PEXO_BASE_URL:-}" && -n "${PEXO_API_KEY:-}" ]]; then tmp_body=$(mktemp) tmp_err=$(mktemp) http_code=$(curl -sS \ --connect-timeout 10 \ -H "Authorization: Bearer $PEXO_API_KEY" \ -H "Content-Type: application/json" \ -o "$tmp_body" \ -w '%{http_code}' \ "${PEXO_BASE_URL}/api/biz/projects?page_size=1" 2>"$tmp_err" || echo "000") ``` ### Technical Analysis `PEXO_BASE_URL` may come from the environment or the sourced configuration file. The scripts only verify that it is non-empty; they do not require HTTPS or verify that the destination belongs to ...[truncated 1692 chars]- Remediation
View remediation