T09 · Insecure Skill Coding Practices
Error
- Location
scripts/email_ops.py:235- Finding
OAuth Credentials Can Be Transmitted to a Plaintext Token Endpoint
- Content
View full analysis
dict: if not config.refresh_token: raise ValueError("Missing refresh token.") if not config.token_endpoint: raise ValueError("Missing token endpoint. Set --token-endpoint or EMAIL_TOKEN_ENDPOINT.") if not config.client_id: raise ValueError("Missing client id. Set --client-id or EMAIL_CLIENT_ID.") payload = { "grant_type": "refresh_token", "refresh_token": config.refresh_token, "client_id": config.client_id, } if config.client_secret: payload["client_secret"] = config.client_secret if config.scope: payload["scope"] = config.scope data = urllib.parse.urlencode(payload).encode("utf-8") request = urllib.request.Request( config.token_endpoint, data=data, method="POST", headers={"Content-Type": "application/x-www-form-urlencoded"}, ) try: with urllib.request.urlopen(request, timeout=30) as response: body = response.read().decode("utf-8") ``` ### Technical Analysis The OAuth token endpoint can be supplied through `--token-endpoint` or `EMAIL_TOKEN_ENDPOINT`, but its URL scheme and destination are not validated before the request is made. The form-encoded POST body contains a reusable refresh token, client ID, optional client secret, and requested scope. If the endpoint uses `http://`, these credentials ...[truncated 1503 chars]- Remediation
View remediation