T09 · Insecure Skill Coding Practices
Error
- Location
wiznote_cli.py:43- Finding
WizNote credentials, session tokens, and note content can be transmitted over plaintext HTTP
- Content
View full analysis
Credentials: resolved_base_url = base_url if base_url is not None else os.getenv("WIZNOTE_BASE_URL") resolved_user = user if user is not None else os.getenv("WIZNOTE_USER") resolved_password = password if password is not None else os.getenv("WIZNOTE_PASSWORD") missing = [] if not resolved_base_url: missing.append("WIZNOTE_BASE_URL") if not resolved_user: missing.append("WIZNOTE_USER") if not resolved_password: missing.append("WIZNOTE_PASSWORD") if missing: raise ValueError(f"Missing WizNote credentials: {', '.join(missing)}") assert resolved_base_url is not None assert resolved_user is not None assert resolved_password is not None return Credentials( base_url=resolved_base_url.rstrip("/"), user=resolved_user, password=resolved_password, ) ``` ```python def login(credentials: Credentials) -> LoginResult: payload = login_request_payload(credentials) request = Request( url=( f"{credentials.base_url.rstrip('/')}" "/as/user/login?clientType=web&clientVersion=4.0&lang=zh-cn" ), data=json.dumps(payload).encode("utf-8"), headers={"Content-type": "application/json"}, method="POST", ) try: with urlopen(request, timeout=DEFAULT_TIMEOUT_SECONDS) as response: response_payload = json.loads(response.read().decode("utf-8")) ``` Token-bearing operations use the same unchecked URL pattern: ```python request = Request( f"{base_url.rstrip('/')}{note ...[truncated 2500 chars]- Remediation
View remediation