T09 · Insecure Skill Coding Practices
Error
- Location
scripts/maker_api.py:20- Finding
JWT Disclosure Through Unrestricted Custom API Base URL
- Content
View full analysis
EnvConfig: """Resolve final base URL from env / override.""" if not jwt_token: raise SystemExit("jwt_token is required for Maker API calls.") if base_url: return EnvConfig(base_url=base_url.rstrip("/"), jwt_token=jwt_token) if env == "test": return EnvConfig(base_url="https://api-qa.proto.stove.finance", jwt_token=jwt_token) # default: production return EnvConfig(base_url="https://proto.stove.finance", jwt_token=jwt_token) def _build_request(url: str, method: str, cfg: EnvConfig, body: Optional[Dict[str, Any]] = None) -> request.Request: if body is not None: data = json.dumps(body).encode("utf-8") else: data = None req = request.Request(url, method=method, data=data) req.add_header("Content-Type", "application/json") req.add_header("Authorization", f"Bearer {cfg.jwt_token}") return req def http_call(req: request.Request) -> Dict[str, Any]: """Perform HTTP request and return parsed JSON.""" try: with request.urlopen(req, timeout=20) as resp: ``` ### Technical Analysis The `--base-url` override is accepted without validating its scheme, hostname, port, or trust relationship. Every request constructed from this URL receives the user's complete bearer JWT in the `Authorization` header. Consequently, the token can be sent directly to an attacker-controlled domain or over plaintext HTTP. The default production and test destinations are legitimate HTTPS endpoints, and authenticated network traffic is required by the Skill's declared purpose. However, unrestricted credential forwarding to any caller-selected endpoint exceeds the minimum privileges necessary. ...[truncated 1367 chars]- Remediation
View remediation