T09 · Insecure Skill Coding Practices
Error
- Location
skills/setup-notifyer/scripts/lib/notifyer-api.js:31- Finding
Authentication Tokens and Credentials Can Be Redirected to an Arbitrary HTTPS Host
- Content
View full analysis
0) { const params = new URLSearchParams(); for (const [key, value] of Object.entries(query)) { if (Array.isArray(value)) { for (const v of value) params.append(`${key}[]`, String(v)); } else if (value !== undefined && value !== null) { params.set(key, String(value)); } } const qs = params.toString(); if (qs) url += `?${qs}`; } const headers = { "Content-Type": "application/json", Accept: "application/json", Origin: defaultOrigin, ...extraHeaders, }; const auth = authHeader(config); if (auth) headers["Authorization"] = auth; let res; try { res = await fetch(url, { method: method.toUpperCase(), headers, body: body !== undefined ? JSON.stringify(body) : undefined, }); ``` ### Technical Analysis The client verifies only that `NOTIFYER_API_BASE_URL` begins with the string `https://`. It does not parse the URL or confirm that its hostnam ...[truncated 2393 chars]- Remediation
View remediation