T09 · Insecure Skill Coding Practices
Error
- Location
scripts/git/repository.py:53- Finding
GitHub Token Disclosure to Attacker-Controlled Hosts Through Weak Host Validation
- Content
View full analysis
str: """Convert repo URL to use authentication if token is provided""" if not self.token or 'github.com' not in repo_url: return repo_url # Remove .git suffix for consistency repo_url = repo_url.rstrip('/') if repo_url.endswith('.git'): repo_url = repo_url[:-4] if '@' in repo_url and '://' in repo_url: parts = repo_url.split('://') # Re-add token return f"{parts[0]}://x-access-token:{self.token}@{parts[1].split('@')[1]}" if repo_url.startswith('https://'): return repo_url.replace('https://', f'https://x-access-token:{self.token}@') elif repo_url.startswith('http://'): return repo_url.replace('http://', f'https://x-access-token:{self.token}@') return repo_url ``` The credential-bearing URL is subsequently used as a Git remote: ```python auth_url = self._make_authenticated_url(repo_url) subprocess.run( ['git', 'remote', 'add', 'origin', auth_url], cwd=target_dir, capture_output=True, timeout=30 ) ``` ### Technical Analysis The code decides whether a repository is hosted by GitHub using the substring condition: ```python 'github.com' in repo_url ``` This does not validate the parsed network hostname. Attacker-controlled addresses such as the following pass the test: ```text https://github.com.attacker.example/repository https://attacker.example/path/github.com/repository ``` For an HTTPS input, the function inserts `GITHUB_TOKEN` into the URL before Git accesses it. Git may therefore transmit the token as HTTP authentication data to an attacker-controlled server. The arbitrary repository URL is accepted directly from the command line without a trusted-host al ...[truncated 1149 chars]- Remediation
View remediation