T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clawcall_client.py:29- Finding
Bearer Token and Sensitive Call Data May Be Transmitted over Cleartext HTTP
- Content
View full analysis
str: value = os.environ.get("CLAWCALL_API_BASE", DEFAULT_API_BASE).strip().rstrip("/") if not value.startswith(("https://", "http://")): raise ClientError("CLAWCALL_API_BASE must use http:// or https://") return value ``` ```python def request( method: str, path: str, payload: dict[str, Any] | None = None, *, authenticated: bool = True, query: dict[str, Any] | None = None, extra_headers: dict[str, str] | None = None, ) -> Any: url = api_base() + path if query: url += "?" + urllib.parse.urlencode( {key: value for key, value in query.items() if value is not None} ) headers = { "Accept": "application/json", "User-Agent": f"openclaw-clawcall-ai-phone-calls/{CLIENT_VERSION}", } if authenticated: headers["Authorization"] = f"Bearer {read_token()}" if extra_headers: headers.update(extra_headers) data = None if payload is not None: data = json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode("utf-8") headers["Content-Type"] = "application/json; charset=utf-8" ``` ### Technical Analysis The configurable `CLAWCALL_API_BASE` accepts both HTTPS and cleartext HTTP URLs. The shared request function subsequently attaches the ClawCall bearer token to authenticated requests and serializes request payloads without imposing any additional transport-security requirement. When an HTTP endpoint is selected, the following information may be transmitted without confidentiality or integrity protection: - The bearer token used to authenticate the ClawCall agent. - Destination phone numbers and business search queries. - Call tasks, first messages, and ...[truncated 2195 chars]- Remediation
View remediation
str: value = os.environ.get("CLAWCALL_API_BASE", DEFAULT_API_BASE).strip().rstrip("/") parsed = urllib.parse.urlsplit(value) if parsed.scheme == "https" and parsed.hostname: return value if parsed.scheme == "http" and parsed.hostname in {"127.0.0.1", "::1", "localhost"}: return value raise ClientError( "CLAWCALL_API_BASE must use HTTPS; HTTP is permitted only for loopback testing" ) ``` 2. Prefer an explicit development-only opt-in flag before permitting loopback HTTP. Keep that flag disabled by default. 3. Validate the parsed URL rather than relying only on a string prefix. Reject malformed URLs, embedded credentials, fragments, and unexpected schemes. 4. Prevent authenticated requests from being redirected from HTTPS to HTTP or to an untrusted origin. Validate the destination of every redirect before forwarding the `Authorization` header. 5. Document that bearer tokens, phone numbers, prompts, transcripts, and call tasks must never be sent through a cleartext remote endpoint. 6. Rotate the bearer token immediately if it may previously have been used with an HTTP endpoint, and review account call history, scheduled calls, inbound-prompt changes, and billing activity. ]]>