T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/video_upscaler.js:83- Finding
Unrestricted JSON Fields Are Transmitted to the External WeryAI API
- Content
View full analysis
controller.abort(), 30000); try { const res = await fetch(url, { method, headers, body: body != null ? JSON.stringify(body) : undefined, signal: controller.signal, }); ``` Submission passes the unrestricted payload directly to the fixed WeryAI endpoint: ```javascript async function submitTool(spec, payload, apiKey) { const res = await httpJson("POST", BASE_URL + spec.endpoint, payload, apiKey); if (!isApiSuccess(res)) return formatApiError(res); ``` ### Technical Analysis The declared upscaler interface requires only `video_url` and optionally accepts `resolution`. However, `buildPayload` merges the entire parsed JSON object into the request payload without rejecting or removing unknown properties. Validation subsequently checks required and recognized fields, but it does not enforce an allowlist. Consequently, arbitrary properties supplied through `--json` survive validation and are serialized into the HTTP reques ...[truncated 1682 chars]- Remediation
View remediation
!allowed.has(key)); if (unknown.length > 0) { throw new Error(`Unsupported input fields: ${unknown.join(", ")}`); } } ``` Apply the following hardening measures: 1. Run unknown-field validation immediately after parsing `--json`. 2. Build the outbound payload exclusively from `video_url` and `resolution`. 3. Preserve the existing enum and HTTPS validation after payload construction. 4. Add tests proving that unexpected fields are rejected and never appear in dry-run or submitted request bodies. 5. Keep the fixed HTTPS API origin and avoid logging the authorization header or API key. ]]>