T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/translate.py:21
- Finding
- User-Controlled API Endpoint Can Expose API Credentials and Submitted Content## Vulnerability Details **File Location**: `scripts/translate.py`, lines 21 and 25–35 **Vulnerability Type**: Unvalidated destination override for authenticated API requests **Risk Level**: Medium ### Vulnerable Code ```python API_BASE = os.environ.get("SOCKETSIO_API_BASE", "https://api.socketsio.com") API_KEY = os.environ.get("SOCKETSIO_API_KEY", "") def _request(method, path, data=None): if not API_KEY: print("Error: SOCKETSIO_API_KEY not set.", file=sys.stderr) print("Get a free key: https://socketsio.com/signup", file=sys.stderr) sys.exit(1) url = f"{API_BASE}{path}" headers = { "X-API-Key": API_KEY, "Content-Type": "application/json", } body = json.dumps(data).encode() if data else None req = urllib.request.Request(url, data=body, headers=headers, method=method) ``` The resulting request is issued at lines 38–39: ```python with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read()) ``` ### Technical Analysis The undocumented `SOCKETSIO_API_BASE` environment variable controls the complete origin used for every API request. The value is concatenated directly with an API path without parsing the URL, enforcing HTTPS, or verifying that the hostname is the intended `api.socketsio.com` service. At the same time, `_request()` unconditionally places `SOCKETSIO_API_KEY` in the `X-API-Key` header. Translation and language-detection requests also include user-supplied text in the JSON body. Consequently, a malicious or incorrectly inherited environment can redirect authenticated requests—and their potentially confidential content—to an arbitrary server. This is an insecure trust-boundary design rather than hidden exfiltration: under the default configuration, requests go to the documented SocketsIO service. Exploitation requires influence over the process environment or launch configuration. ### Attack P ...[truncated 1393 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the runtime endpoint override and hard-code the production origin: ```python API_BASE = "https://api.socketsio.com" ``` 2. If endpoint configurability is operationally necessary, parse and strictly validate it before constructing requests: - Require the `https` scheme. - Require the exact approved hostname. - Reject embedded credentials, fragments, unexpected ports, and deceptive hostnames. - Construct URLs with `urllib.parse` rather than direct string concatenation. 3. Enforce the allowlist immediately before attaching the API key so future refactoring cannot send credentials to an untrusted origin. 4. Separate development and production credentials. Permit custom endpoints only through an explicit development mode that refuses to attach production API keys. 5. Document the endpoint override and its security implications if it remains supported. 6. Add automated tests confirming that values such as `http://...`, `https://attacker.example`, `https://api.socketsio.com.attacker.example`, and URLs with unexpected ports are rejected before network access occurs.