T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/volcengine_supabase/platform/aidap_client.py:33
- Finding
- Privileged service-role credentials are transmitted over plaintext HTTP by default## Vulnerability Details **File Location**: `scripts/call_volcengine_supabase.py:103`, `scripts/volcengine_supabase/platform/aidap_client.py:33,342-384`, `scripts/volcengine_supabase/platform/supabase_client.py:62-78` **Vulnerability Type**: Plaintext transmission of privileged credentials **Risk Level**: High ### Vulnerable Code `scripts/call_volcengine_supabase.py:103`: ```python parser.add_argument("--endpoint-scheme", default=os.getenv("SUPABASE_ENDPOINT_SCHEME", "http"), help="workspace URL 协议") ``` `scripts/volcengine_supabase/platform/aidap_client.py:33,342-384`: ```python ENDPOINT_SCHEME = os.getenv("SUPABASE_ENDPOINT_SCHEME", "http").strip().lower() or "http" async def get_endpoint(self, workspace_id: str, branch_id: Optional[str] = None, use_cache: bool = True) -> Optional[str]: cache_key = f"{workspace_id}:{branch_id}" if branch_id else workspace_id endpoint_cache = get_endpoint_cache() if use_cache and cache_key in endpoint_cache: return endpoint_cache[cache_key] if not branch_id: branch_id = await self.get_default_branch_id(workspace_id) if not branch_id: return None try: request = DescribeWorkspaceEndpointRequest( workspace_id=workspace_id, branch_id=branch_id ) response = self.client.describe_workspace_endpoint(request) if hasattr(response, 'endpoints') and response.endpoints: domains = [] for endpoint in response.endpoints: if hasattr(endpoint, 'addresses') and endpoint.addresses: for addr in endpoint.addresses: if hasattr(addr, 'address_domain'): domains.append(addr.address_domain) for domain in domains: if 'volces.com' in domain and 'ivolces.com' not in domain: if ENDPOINT_SCHEME == "https": ...[truncated 3201 chars]
- Remediation
- ## Remediation Suggestions - Change the default endpoint scheme to HTTPS. - Reject any endpoint whose parsed scheme is not exactly `https`; do not provide an HTTP downgrade option for authenticated traffic. - Remove the port 80 endpoint construction path. - Parse endpoints with a URL parser and validate hostnames using an exact hostname or approved domain-suffix allowlist rather than substring matching. - Do not silently fall back to an arbitrary first domain. - Preserve normal TLS certificate and hostname verification in `httpx`. - Consider using short-lived, narrowly scoped credentials instead of a long-lived service-role key. - Rotate any service-role keys that may already have been transmitted through the default HTTP configuration. - Add automated tests that fail if privileged API calls can be constructed with a non-HTTPS URL.