T09 · Insecure Skill Coding Practices
Error
- Location
scripts/configure.py:43- Finding
API Key Disclosure Through Arbitrary or Plaintext API Endpoints
- Content
View full analysis
str: value = raw.strip().rstrip("/") parsed = parse.urlparse(value) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise ValueError("API base must be an HTTP(S) URL") if parsed.username or parsed.password: raise ValueError("API base must not contain credentials") return value def verify(api_base: str, api_key: str) -> None: endpoint = api_base + "/api/UserapikeyMstr/GetToken/" + parse.quote(api_key, safe="") payload = json.dumps({"apiKey": api_key}).encode("utf-8") req = request.Request( endpoint, data=payload, method="POST", headers={ "Accept": "application/json", "Content-Type": "application/json", "X-API-Key": api_key, }, ) try: with request.urlopen(req, timeout=15) as response: decoded = json.loads(response.read().decode("utf-8")) ``` The user-selected endpoint is subsequently persisted: ```python def main() -> int: hermes_home = Path(os.environ.get("HERMES_HOME", str(Path.home() / ".hermes"))).expanduser() credentials_path = hermes_home / "aidenote-credentials.json" try: api_base = validate_base(input(f"AideNote API base [{DEFAULT_API_BASE}]: ").strip() or DEFAULT_API_BASE) api_key = getpass.getpass("AideNote API Key: ").strip() if not api_key: raise ValueError("API Key is required") verify(api_base, api_key) write_credentials(credentials_path, api_base, api_key) ``` From `scripts ...[truncated 4093 chars]- Remediation
View remediation