T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scraper.py:15- Finding
Undeclared session-cookie access with overly broad cookie forwarding
- Content
View full analysis
Optional[str]: try: resp = SESSION.get(url, timeout=timeout) ``` `scripts/search_products.py`: ```python _OPTIONAL_COOKIE = os.environ.get("ALI_COOKIE", "") if _OPTIONAL_COOKIE: HEADERS["Cookie"] = _OPTIONAL_COOKIE resp = requests.get(url, params=params, headers=HEADERS, timeout=15) ``` `scripts/search_factories.py`: ```python _OPTIONAL_COOKIE = os.environ.get("ALI_COOKIE", "") if _OPTIONAL_COOKIE: HEADERS["Cookie"] = _OPTIONAL_COOKIE resp = requests.get(url, params=params, headers=HEADERS, timeout=15) ``` `scripts/product_detail.py`: ```python _OPTIONAL_COOKIE = os.environ.get("ALI_COOKIE", "") if _OPTIONAL_COOKIE: HEADERS["Cookie"] = _OPTIONAL_COOKIE resp = requests.get(url, params=params, headers=HEADERS, timeout=15) url2 = f"https://m.1688.com/offer/{product_id}.html" resp2 = requests.get(url2, headers=HEADERS, timeout=15) ``` The Skill manifest declares only these optional environment variables: ```yaml env: - name: ALI_APP_KEY required: false - name: ALI_APP_SECRET required: false ``` It does not declare `ALI_COOKIE`. ### Technical Analysis The four affected scripts read a complete authenticated browser-session cookie from `ALI_COOKIE` and place it directly into a generic HTTP `Cookie` header. This ...[truncated 2261 chars]- Remediation
View remediation