T09 · Insecure Skill Coding Practices
Error
- Location
tool.py:24- Finding
API credentials can be transmitted to arbitrary or plaintext endpoints
- Content
View full analysis
str: """ 根据 apiKey 前缀自动选择环境： - uat_* -> http://api.uat.egatee.net - 其他 -> https://api.egatee.com """ k = (api_key or "").strip() if k.lower().startswith("uat_"): return "http://api.uat.egatee.net" return "https://api.egatee.com" def get_notify_base_url(api_key: str) -> str: # 允许显式覆盖（比如临时走 matata-global 域名/私有网关） explicit = get_optional_env("EGATEE_NOTIFY_BASE_URL") if explicit: return explicit.rstrip("/") inferred = infer_base_url_by_api_key(api_key).rstrip("/") _debug_log(f"EGATEE_NOTIFY_BASE_URL not set, inferred base_url={inferred}") return inferred ``` ```python def build_headers(api_key: str = "", auth_token: str = "") -> Dict[str, str]: headers = {"Content-Type": "application/json"} if api_key: headers["X-API-Key"] = api_key if auth_token: headers["Authorization"] = f"Bearer {auth_token}" # 用于后端日志定位（CommonConstant.REQUEST_ID = "ADMIN_REQUEST_ID"） request_id = os.getenv("EGATEE_REQUEST_ID", "").strip() if not request_id: request_id = uuid.uuid4().hex headers["ADMIN_REQUEST_ID"] = request_id return headers ``` ```python def post_json(url: str, headers: Dict[str, str], body: Dict[str, Any], timeout: int) -> Dict: try: _debug_log(f"HTTP POST {url}") _debug_log(f" headers={json.dumps(_redact_headers(headers), ensure_ascii=False)}") _debug_log(f" body={json.dumps(body, ensure_ascii=False)}") resp = requests.post(url, headers=headers, data=json.dumps(body), timeout=timeout) ``` ```python base_url = get_notify_base_url(api_key) headers = build_headers(api_key=api_key, auth_token=au ...[truncated 3090 chars]- Remediation
View remediation