gcp-tasks-http-request-body

With responseView=FULL, an HTTP task body may disclose credentials or sensitive application payloads.

gcpcritical service: gcp:tasks emits CanReadData

Where it sits

locationcloudtasks.projects.locations.queues.tasks.get.httpRequest.body
location kindmessage_body
data kindscredential customer_data pii sensitive_data
emits edgeCanReadData
serviceCloud Tasks (gcp:tasks)

Collection recipe

access moderead_api
operationcloudtasks.projects.locations.queues.tasks.get
response pathhttpRequest.body
encodingbase64
params{"name": "projects/\u003cproject\u003e/locations/\u003clocation\u003e/queues/\u003cqueue\u003e/tasks/\u003ctask\u003e", "responseView": "FULL"}

Required permissions

cloudtasks.tasks.get
cloudtasks.tasks.fullView

References

move · open · esc close