T09 · Insecure Skill Coding Practices
Error
- Location
fetcher.py:699- Finding
Private Portfolio Data Can Be Sent to Arbitrary HTTP Endpoints
- Content
View full analysis
bool: """Send a message to Feishu. Supports: 1. Webhook URL 2. App ID + Secret """ import requests # Webhook method if webhook and webhook.startswith('http'): payload = { "msg_type": "text", "content": { "text": message } } try: response = requests.post(webhook, json=payload, timeout=30) return response.status_code == 200 except Exception as e: print(f"Send failed: {e}") return False return False ``` The original source uses Chinese comments and messages, but the executable condition is: ```python if webhook and webhook.startswith('http'): response = requests.post(webhook, json=payload, timeout=30) ``` `main.py:164-194`: ```python for code in codes: code = code.strip() if not code: continue # Retrieve quote result = fetcher.get_quote(code) # Retrieve local position position = trader.get_position(code) # Generate a card containing position information message = fetcher.format_table(result, position) messages.append(message) # Combine multiple cards full_message = messages[0] if len(messages) == 1 else json.dumps({ 'config': {'wide_screen_mode': True}, 'header': {'title': {'tag': 'plain_text', 'content': '📊 Multiple stock quotes'}, 'template': 'blue'}, 'elements': [{'tag': 'div', 'text': {'tag': 'lark_md', 'content': m}} for m in messages] }) if args.webhook: text_content = "\n\n---\n\n".join([ json.loads(m).get('elements', [])[0].get('text', {}).get('content', '') if m.startswith('{ ...[truncated 3603 chars]- Remediation
View remediation