T09 · Insecure Skill Coding Practices
Error
- Location
read.py:183- Finding
Authentication Cookies Are Disclosed to a Third-Party Service and Exposed Through Command-Line Arguments
- Content
View full analysis
Dict[str, Any] | str: """Call UniFuncs Web Reader API and return parsed response.""" json_data = json.dumps(payload).encode("utf-8") headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } req = urllib.request.Request(API_URL, data=json_data, headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT_SECONDS) as response: response_data = response.read().decode("utf-8") ``` The corresponding documentation explicitly presents this option: ```text --set-cookie SET_COOKIE Set Cookie header value for pages requiring authentication. ``` ### Technical Analysis The `--set-cookie` option accepts a complete HTTP cookie value through a command-line argument. The implementation places that value in the `setCookie` field of a JSON request and sends it to the fixed third-party endpoint `https://api.unifuncs.com/api/web-reader/read`. This creates two credential-exposure channels: 1. The cookie can be recorded in shell history or exposed to local process-inspection facilities because it is supplied through `argv`. 2. The complete cookie is disclosed to UniFuncs so that its infrastructure can retrieve the authenticated page. Authenticated-page retrieval may legitimately require the remote service to receive a credential, but this behavior is optional and is not required for ordinary publ ...[truncated 1753 chars]- Remediation
View remediation