T09 · Insecure Skill Coding Practices
Error
- Location
- jira_task_creator.py:141
- Finding
- Jira bearer token and sensitive Jira data can be transmitted over plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `jira_task_creator.py:141-147`, `jira_task_creator.py:192-196`, `SKILL.md:42-43`, `SKILL.md:53-54`, `PROJECT.md:20-21`, `package.json:62-66` **Vulnerability Type**: Cleartext transmission of credentials and sensitive data **Risk Level**: High ### Vulnerable Code The application constructs request URLs directly from the configured base URL and attaches the Jira bearer token without enforcing HTTPS: ```python url = f"{self.base_url.rstrip('/')}{endpoint}" headers = { "Authorization": f"Bearer {self.token}", "Content-Type": "application/json" } try: response = requests.get(url, headers=headers, params=params, timeout=30) ``` Issue creation uses the same unrestricted base URL and sends the bearer token together with issue data: ```python url = f"{base_url.rstrip('/')}/rest/api/3/issue" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } try: response = requests.post(url, headers=headers, json=issue_data, timeout=30) ``` The documentation explicitly demonstrates an unencrypted HTTP endpoint: ```bash export JIRA_BASE_URL="http://your-jira.com" export JIRA_BEARER_TOKEN="your-token-here" ``` The package configuration also uses HTTP in its example: ```json "JIRA_BASE_URL": { "required": true, "description": "Jira server base URL (e.g., http://your-jira.com)" }, "JIRA_BEARER_TOKEN": { "required": true, "description": "Jira Bearer Token for authentication" } ``` ### Technical Analysis Network communication with the configured Jira server is necessary for the declared issue-creation and user-search functionality. Sending a Jira authentication token and the requested Jira records to that server therefore does not inherently exceed the skill's functional scope. However, the implementation accepts any URL scheme and the documentation actively recommends `http://`. When HTTP is used, TLS does not protect the `Authorization: Bearer` header, user-se ...[truncated 2467 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce HTTPS before issuing any request: ```python from urllib.parse import urlparse parsed = urlparse(base_url) if parsed.scheme != "https": return { "success": False, "error": "JIRA_BASE_URL must use HTTPS" } ``` 2. Apply the same validation in both `create_issue()` and `UserSearcher.__init__()`, ideally through a shared configuration-validation function. 3. If plaintext HTTP is required for isolated local development, require a clearly named explicit opt-in such as `JIRA_ALLOW_INSECURE_HTTP=true`. Default to rejection and display a prominent warning. 4. Replace every documented `http://your-jira.com` example with `https://your-jira.com`. 5. Allow administrators to configure an approved hostname or origin and reject requests to other destinations. This reduces the risk of token exfiltration through configuration tampering. 6. Preserve normal TLS certificate verification. If private certificate authorities are used, support a configured CA bundle rather than disabling certificate validation. 7. Use a dedicated Jira service account with only the project and issue permissions required for issue creation and assignable-user search. 8. Rotate any token that may previously have been used over plaintext HTTP and review Jira access logs for suspicious API activity. 9. Avoid returning unrestricted `response.text` to downstream callers because Jira error responses may contain internal details. Parse and return a minimal, sanitized error message instead. ]]>