T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/media_gen_client.py:43- Finding
Bearer Token Exposure Through Unrestricted HTTP Redirects
- Content
View full analysis
Dict[str, Any]: all_headers = { "Authorization": f"Bearer {api_key}", "Accept": "application/json", "User-Agent": user_agent, } if headers: all_headers.update(headers) data: Optional[bytes] = None if body is not None: data = json.dumps(body).encode("utf-8") all_headers.setdefault("Content-Type", "application/json") elif method.upper() in {"POST", "PUT", "PATCH"}: data = b"{}" all_headers.setdefault("Content-Type", "application/json") req = urllib.request.Request(url, data=data, headers=all_headers, method=method.upper()) try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: ``` ### Technical Analysis The client places the AIsa API key in the `Authorization` header and submits the request through `urllib.request.urlopen`. Python's default URL opener automatically processes HTTP redirects. The code neither disables redirects nor verifies that a redirect remains on the expected HTTPS origin. Consequently, the authenticated request can cross from the trusted `api.aisa.one` origin to another origin without an application-level authorization check. Redirect processing may propagate sensitive request headers, including the bearer token. This behavior exceeds the minimum privilege needed for the declared functionality: the credential only needs to be disclosed to the documented AIsa API origin. Exploitation requires control over, or compromise of, an endpoint in the authenticated reque ...[truncated 1179 chars]- Remediation
View remediation