T09 · Insecure Skill Coding Practices
Error
- Location
openclaw-soundcloud-watcher/soundcloud_watcher.ts:403- Finding
OAuth Access Token Can Be Forwarded to an Untrusted Pagination URL
- Content
View full analysis
[k, String(v)]) ) ).toString(); fullUrl = `${fullUrl}${sep}${query}`; } const headers: Record = {}; if (this.config.accessToken) { headers["Authorization"] = `OAuth ${this.config.accessToken}`; } try { const resp = await fetch(fullUrl, { headers, signal: AbortSignal.timeout(API_TIMEOUT_MS), }); ``` The remotely supplied pagination URL reaches the method above through this code: ```ts const nextHref = data.next_href; if (nextHref && nextHref !== nextUrl) { nextUrl = nextHref; params = undefined; } else { break; } ``` ### Technical Analysis The API client accepts any string beginning with `http` as a complete request URL. It then attaches the SoundCloud OAuth access token to that request without checking the URL's scheme, hostname, port, or origin. The follower pagination logic obtains `next_href` from a remote API response and passes it back into this generic request method. Consequently, the trust decision about where an authenticated request may be sent is indirectly controlled by remote response data. This violates the security requirement that bearer-style credentials must only be transmitted to explicitly trusted origins. The check also accepts both `http://` and `https://` strings because it only tests `startsWith("http")`; therefore, a supplied HTTP URL could additionally expose the token in plaintext over the netw ...[truncated 1951 chars]- Remediation
View remediation