T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.sh:58- Finding
Authentication Tokens and Financial Data May Be Transmitted over Plaintext HTTP
- Content
View full analysis
/dev/null) || { rm -f "$tmp"; return 1; } ``` ```bash # scripts/_common.sh:158-174 local token token=$(ea_load_token) if [[ "$method" == "GET" ]]; then curl -sS -w '\n__HTTP_STATUS__:%{http_code}' \ -H "authorization: $token" \ "${EASYACCOUNTS_URL}/api${path}" else local tmp tmp=$(_ea_write_body_tmp "$body") curl -sS -w '\n__HTTP_STATUS__:%{http_code}' \ -H "authorization: $token" \ -H "Content-Type: application/json; charset=utf-8" \ -X "$method" \ --data-binary "@$tmp" \ "${EASYACCOUNTS_URL}/api${path}" rm -f "$tmp" fi ``` The documented configuration explicitly provides a plaintext HTTP example: ```bash # README.md:36-45 # Required EASYACCOUNTS_URL=http://your-easyaccounts-server:8081 # Optional EASYACCOUNTS_USERNAME=admin EASYACCOUNTS_PASSWORD=yourpassword ``` ### Technical Analysis The URL validation accepts both `http://` and `https://` without restricting plaintext HTTP to loopback or another demonstrably secure transport. The same base URL is used for login, bearer-token transmission, financial-data queries, transaction creation, and transaction updates. The login protocol hashes the password with MD5 before sending it, but this does not compensate ...[truncated 1825 chars]- Remediation
View remediation