📦
审计历史
connector-googlemail - 1 审计
审计版本 1 最新
2026年7月23日 10:16
All 255 static findings are false positives caused by Markdown backticks, documented Google and Mops URLs, fixed relative links/imports, ellipses, and Gmail or OIDC terminology. Semantic review found unvalidated RFC 5322 headers and a disconnect flow that deletes local state without revoking Google's refresh token.
1
已扫描文件
764
分析行数
5
复核项
0
已忽略误报
已确认安全问题 (2)
高
RFC 5322 Header Injection
The sample concatenates `to` and `subject` directly into RFC 5322 headers. Newlines can inject headers, add recipients, or alter message structure.
Lines 390-392 show direct concatenation with no CR or LF validation before the message is sent.
中
Disconnect Does Not Revoke Google Token
The disconnect endpoint removes the map entry without revoking the Google refresh token. A previously exposed token remains usable after users disconnect.
Lines 303-307 only remove local state and contain no Google token revocation call.
风险因素
⚙️ 外部命令 (50)
SKILL.md:6 SKILL.md:7 SKILL.md:8 SKILL.md:10 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:34 SKILL.md:37 SKILL.md:44 SKILL.md:48 SKILL.md:49 SKILL.md:56 SKILL.md:60 SKILL.md:62 SKILL.md:65 SKILL.md:72-76 SKILL.md:76-84 SKILL.md:84 SKILL.md:85-87 SKILL.md:87-89 SKILL.md:89-90 SKILL.md:90 SKILL.md:92-98 SKILL.md:98-99 SKILL.md:99-111 SKILL.md:111-118 SKILL.md:118 SKILL.md:119 SKILL.md:120-121 SKILL.md:121-123 SKILL.md:123-124 SKILL.md:124 SKILL.md:125-126 SKILL.md:126 SKILL.md:127-128 SKILL.md:128-135 SKILL.md:135-137 SKILL.md:137-138 SKILL.md:138 SKILL.md:139 SKILL.md:140-141 SKILL.md:141 SKILL.md:142-143 SKILL.md:143 SKILL.md:148-149 SKILL.md:149-151 SKILL.md:151 SKILL.md:153-156 SKILL.md:156-162
🌐 网络访问 (20)
审计者: codex