T09 · Insecure Skill Coding Practices
Error
- Location
src/lib/l402.ts:3- Finding
Authentication credentials can be redirected to an arbitrary network origin
- Content
View full analysis
= {}, l402Token?: string, ): Promise { const url = buildUrl(action, params); const headers: Record = { 'Accept': 'application/json', 'User-Agent': 'playasia-mcp/0.1.0', }; if (l402Token) { headers['Authorization'] = `L402 ${l402Token}`; } const res = await fetch(url.toString(), { headers }); ``` ```typescript export async function platformFetch( action: string, params: Record = {}, token: string, method: 'GET' | 'POST' = 'GET', body?: Record, ): Promise> { const url = buildUrl(action, params); const headers: Record = { 'Accept': 'application/json', 'User-Agent': 'playasia-mcp/0.1.0', 'X-PA-Token': token, }; const init: RequestInit = { method, headers }; if (body && method === 'POST') { headers['Content-Type'] = 'application/json'; init.body = JSON.stringify(body); } const res = await fetch(url.toString(), init); ``` The unrestricted override is also publicly documented: ```markdown | `PA_BASE_URL` | No | Override API base URL (default: `https://www.play-asia.com`) | ``` ### Technical Analysis `PA_BASE_URL` controls the origin used by all API requests. The implementation does not enforce HTTPS, validate the hostname, maintain an origin allowlist, or prevent credentials from being attached when the configured origin differs from the official Play-Asia service. Consequently, both of the following secrets can be sent to an arbitrary server: - `PA_TOKEN`, through the `X-PA-Token` header. - L402 maca ...[truncated 1840 chars]- Remediation
View remediation