T09 · Insecure Skill Coding Practices
- Location
scripts/odoo_client.py:183- Finding
Odoo credentials can be transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/odoo_client.py:183-187,scripts/odoo_client.py:229-237,scripts/odoo_client.py:259-264
Vulnerability Type: Cleartext transmission of authentication credentials
Risk Level: HighTechnical Analysis
normalize_url()adds HTTPS only when the supplied address has no recognized scheme. An explicitly suppliedhttp://address remains unchanged:python def normalize_url(url: str) -> str: """Normalize the system address and add HTTPS when no scheme is present.""" url = (url or "").strip().rstrip("/") if url and not url.startswith(("http://", "https://")): url = "https://" + url return urlThe resulting URL is then used for authentication. Both supported transports include the Odoo password or API key in requests to the configured server:
python if self.transport == "jsonrpc": self.uid = self._jsonrpc( "common", "authenticate", [self.db, self.login, self.secret, {}] ) else: common = xmlrpc.client.ServerProxy(f"{self.url}/xmlrpc/2/common") self.uid = common.authenticate(self.db, self.login, self.secret, {})The JSON-RPC path likewise sends its request directly to the configured scheme:
python req = urllib.request.Request( f"{self.url}/jsonrpc", data=json.dumps(payload).encode("utf-8"), headers={"Content-Type": "application/json"}, ) with urllib.request.urlopen(req, timeout=60) as resp: data = json.loads(resp.read().decode("utf-8"))The URL can originate from interactive initialization,
login.py set --url,HUO15_ODOO_URL, or the saved configuration. Although the default address is HTTPS and scheme-less addresses are upgraded, explicit HTTP remains accepted without warning or an unsafe-mode gate.Attack Path
- The Skill is configured with an Odoo endpoint beginning with
http://. - The user supplies a password or API key during ...[truncated 800 chars]
- The Skill is configured with an Odoo endpoint beginning with
- Remediation
View remediation
Remediation Suggestions
- Reject all non-HTTPS remote endpoints in
normalize_url()and again immediately before authentication. - If plaintext HTTP is required for local development, require an explicit unsafe option and restrict it to loopback addresses such as
127.0.0.1and::1. - Never permit the unsafe option when password authentication is selected.
- Emit a clear error before reading or sending the secret when the URL does not satisfy the transport policy.
- Consider validating TLS certificates using the platform trust store and documenting any supported private certificate-authority configuration.
- Add tests confirming that
http://example.comis rejected while scheme-less addresses are normalized to HTTPS.
- Reject all non-HTTPS remote endpoints in