T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/volcengine_supabase/platform/aidap_client.py:27
- Finding
- Privileged Supabase service-role key transmitted over plaintext HTTP by default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/volcengine_supabase/platform/aidap_client.py:27,342-384`; `scripts/volcengine_supabase/tools/base.py:46-58`; `scripts/volcengine_supabase/platform/supabase_client.py:43-78` **Vulnerability Type**: Cleartext transmission of privileged credentials **Risk Level**: High ### Vulnerable Code ```python # scripts/volcengine_supabase/platform/aidap_client.py ENDPOINT_SCHEME = os.getenv("SUPABASE_ENDPOINT_SCHEME", "http").strip().lower() or "http" async def get_endpoint( self, workspace_id: str, branch_id: Optional[str] = None, use_cache: bool = True ) -> Optional[str]: # ... for domain in domains: if 'volces.com' in domain and 'ivolces.com' not in domain: if ENDPOINT_SCHEME == "https": result = f"https://{domain}" else: result = f"http://{domain}:80" endpoint_cache[cache_key] = result return result if domains: if ENDPOINT_SCHEME == "https": result = f"https://{domains[0]}" else: result = f"http://{domains[0]}:80" endpoint_cache[cache_key] = result return result ``` ```python # scripts/volcengine_supabase/tools/base.py async def _get_client( self, workspace_id: str, branch_id: Optional[str] = None ) -> SupabaseClient: endpoint = await self.aidap.get_endpoint(workspace_id, branch_id=branch_id) if not endpoint: target = branch_id or workspace_id raise ValueError(f"Could not get endpoint for target {target}") api_key = await self.aidap.get_api_key( workspace_id, "service_role", branch_id=branch_id ) if not api_key: target = branch_id or workspace_id raise ValueError(f"Could not get API key for target {target}") return SupabaseClient(endpoint, api_key) ``` ```python # scripts/volcengine_supabase/platform/supabase_client.py class SupabaseClient: ...[truncated 2835 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make HTTPS mandatory: - Change the default scheme to `https`. - Reject every scheme other than `https`; do not silently convert unknown values to HTTP. - Remove the port-80 construction path. 2. Validate discovered endpoints: - Parse endpoints with a standard URL parser. - Require an expected Volcengine/Supabase hostname suffix using label-aware comparison. - Reject IP literals, localhost, private-address destinations, user-info components, fragments, and unexpected ports. - Do not fall back to an arbitrary first domain. 3. Ensure certificate verification remains enabled and use an approved CA trust store. Consider certificate pinning where operationally feasible. 4. Use a less-privileged credential whenever a service-role key is unnecessary. 5. Rotate all service-role keys that may previously have traversed plaintext HTTP, and review access logs for unauthorized use. 6. Add automated tests asserting that privileged requests can never be emitted to an `http://` URL. ]]>