T09 · Insecure Skill Coding Practices
Warning
- Location
src/api.js:12- Finding
Caller-Controlled API Origin Can Receive Feishu Bearer Tokens
- Content
View full analysis
{ if (!this.accessToken) { await this.refreshAccessToken(); } config.headers.Authorization = `Bearer ${this.accessToken}`; return config; }); ``` ### Technical Analysis The exported `FeishuBitableAPI` constructor accepts an unrestricted `options.baseURL`. The Axios request interceptor subsequently adds a valid Feishu bearer token to every request sent through the configured client. There is no validation requiring the destination to use HTTPS or belong to the expected `open.feishu.cn` origin. Consequently, a programmatic caller that can influence constructor options can redirect authenticated API requests to an arbitrary server. The bundled CLI does not expose `baseURL`, which reduces direct exploitability through normal command-line usage. However, `src/api.js` is also the package's main exported interface, so applications integrating the package programmatically may pass configuration from environment files, user input, or another untrusted source. ### Attack Path 1. An application imports the package and constructs `FeishuBitableAPI` with externally influenced options. 2. An attacker causes `options.baseURL` to reference an attacker-controlled server. 3. The client obtains a tenant access token using the configured Feishu application ID and s ...[truncated 973 chars]- Remediation
View remediation
{ const finalUrl = new URL(config.url, configuredUrl); if (finalUrl.origin !== TRUSTED_ORIGIN) { throw new Error('Refusing to send credentials to an untrusted origin'); } if (!this.accessToken) { await this.refreshAccessToken(); } config.headers.Authorization = `Bearer ${this.accessToken}`; return config; }); ``` ]]>