T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rbs_client.py:15- Finding
Configurable RBS endpoint permits plaintext transmission of bearer tokens and sensitive account data
- Content
View full analysis
dict[str, str]: h = {"Content-Type": "application/json"} key = os.environ.get("AC_API_KEY") if key: h["Authorization"] = f"Bearer {key}" return h def _base_url() -> str: return os.environ.get("RBS_BASE_URL", DEFAULT_BASE) def _post(session_id: str, path: str, data: Optional[dict[str, Any]] = None) -> requests.Response: base = _base_url() url = f"{base}/api/sessions/{session_id}{path}" return requests.post(url, headers=_headers(), json=data or {}, timeout=60) def _get(session_id: str, path: str, params: Optional[dict[str, str]] = None) -> requests.Response: base = _base_url() url = f"{base}/api/sessions/{session_id}{path}" return requests.get(url, headers=_headers(), params=params or {}, timeout=60) ``` ### Technical Analysis The application accepts `RBS_BASE_URL` directly from the process environment and uses it as the destination for every Remote Browser Service request. It does not validate that the configured URL: - Uses HTTPS. - Refers to an approved RBS hostname. - Excludes embedded user information. - Resolves to an expected network destination. At the same time, `_headers()` attaches `AC_API_KEY` as a bearer token to requests sent to that endpoint. The same HTTP channel carries browser actions and data associated with Bumble authentication and account operation, potentially including phone numbers, SMS verification codes, messages, profile information, and session-control requests. If `RBS_BASE_URL` is configured with an `http://` URL, TLS protection is lost. A malicious endpoint would directly receive the bearer token and request contents, while an on-path attacker could observe or alter plaintext traffic. This issue requi ...[truncated 1782 chars]- Remediation
View remediation
str: raw = os.environ.get("RBS_BASE_URL", DEFAULT_BASE).rstrip("/") parsed = urlsplit(raw) if parsed.scheme != "https": raise ValueError("RBS_BASE_URL must use HTTPS") if not parsed.hostname or parsed.username or parsed.password: raise ValueError("RBS_BASE_URL is invalid") if parsed.query or parsed.fragment: raise ValueError("RBS_BASE_URL must not contain a query or fragment") return raw ``` ]]>