T09 · Insecure Skill Coding Practices
Error
- Location
strategy_common.py:103- Finding
Financial API credentials can be forwarded to an unrestricted network origin
- Content
View full analysis
requests.Session: session = requests.Session() session.headers.update({"X-API-KEY": MAXXIT_API_KEY, "Content-Type": "application/json"}) return session def api_get( session: requests.Session, path: str, params: Optional[Dict[str, Any]] = None, ) -> Optional[Dict[str, Any]]: url = f"{MAXXIT_API_URL}/api/lazy-trading/programmatic/{path}" try: response = session.get(url, params=params, timeout=REQUEST_TIMEOUT) response.raise_for_status() return response.json() except requests.RequestException as exc: log(f"GET {path} failed: {exc}") return None def api_post( session: requests.Session, path: str, payload: Dict[str, Any], ) -> Optional[Dict[str, Any]]: url = f"{MAXXIT_API_URL}/api/lazy-trading/programmatic/{path}" try: response = session.post(url, json=payload, timeout=REQUEST_TIMEOUT) response.raise_for_status() return response.json() except requests.RequestException as exc: log(f"POST {path} failed: {exc}") return None ``` The Skill documentation also instructs authenticated requests to follow redirects: ```bash curl -L -X GET "${MAXXIT_API_URL}/api/lazy-trading/programmatic/zerodha/session" \ -H "X-API-KEY: ${MAXXIT_API_KEY}" \ -H "X-KITE-API-KEY: ${KITE_API_KEY}" \ -H "X-KITE-ACCESS-TOKEN: ${KITE_ACCESS_TOKE ...[truncated 2239 chars]- Remediation
View remediation