T09 · Insecure Skill Coding Practices
Error
- Location
scripts/page_analyzer.py:27- Finding
Authenticated Page HTML Is Transmitted to an External LLM with Incomplete Redaction
- Content
View full analysis
str: """脱敏：移除 script/style、常见 token 模式，压缩空白。""" html = re.sub(r"]*>[\s\S]*?", "", html, flags=re.IGNORECASE) html = re.sub(r"]*>[\s\S]*?", "", html, flags=re.IGNORECASE) for pat, repl in _TOKEN_PATTERNS: html = pat.sub(repl, html) html = re.sub(r"\s+", " ", html).strip() return html def _get_page_summary(page) -> str: """获取页面内容摘要：URL + 脱敏后的简化 HTML。""" try: url = page.url html = page.content() html = _sanitize_html(html) if len(html) > MAX_HTML_CHARS: html = html[:MAX_HTML_CHARS] + "\n...[已截断]" return f"URL: {url}\n\nHTML(简化):\n{html}" except Exception as e: return f"获取页面失败：{e}" ``` ```python def _call_openai(prompt: str, api_key: str | None, base_url: str | None) -> str | None: """调用 OpenAI 兼容 API。支持百炼、Ollama（本地无需 Key）等。""" if not OpenAI: return None url = ( base_url or os.environ.get("XHS_ANALYZER_BASE_URL") or os.environ.get("OPENAI_BASE_URL") or BAILIAN_BASE_URL ) key = ( api_key or os.environ.get("DASHSCOPE_API_KEY") or os.environ.get("OPENAI_API_KEY") ) if not key and not _is_local_endpoint(url): return None client = OpenAI(api_key=key or "ollama", base_url=url) model_name = os.environ.ge ...[truncated 2855 chars]- Remediation
View remediation