T09 · Insecure Skill Coding Practices
Warning
- Location
examples/client.py:22- Finding
Bearer credentials can be transmitted over unencrypted HTTP
- Content
View full analysis
dict[str, str]: if not authenticated: return {} if not TOKEN: raise OracleXError( "This endpoint needs a signed-in user. Set ORACLE_X_TOKEN to a " "Supabase access token (see references/auth.md)." ) return {"Authorization": f"Bearer {TOKEN}"} ``` The related configuration documentation explicitly allows a remote instance without requiring TLS: ```bash export ORACLE_X_URL=http://localhost:8000 # default; set for a remote instance export ORACLE_X_TOKEN=... # only for chat and watchlist ``` ### Technical Analysis The client reads an unrestricted, user-controlled base URL from `ORACLE_X_URL`. For authenticated requests, it attaches a live Supabase JWT using the HTTP `Authorization` header. The URL is not parsed or validated to ensure that non-loopback destinations use HTTPS. Plain HTTP is generally acceptable for a service bound exclusively to the local loopback interface. However, the documentation permits users to set the variable to a remote instance without requiring an `https://` scheme. If a remote plaintext endpoint is configured, the JWT and authenticated request or response content can be observed or modified by an attacker with a network position. The credential is necessary for the declared authenticated functionality, and the implementation correctly avoids attaching it to public calls. The security issue is therefore not excessive credential use, but the absence of transport and destination controls around ...[truncated 1584 chars]- Remediation
View remediation