T09 · Insecure Skill Coding Practices
Error
- Location
scripts/idfm.py:251- Finding
Caller-Controlled Base URL Can Exfiltrate the IDFM API Key
- Content
View full analysis
dict: req = urllib.request.Request(url) req.add_header("apikey", api_key) req.add_header("accept", "application/json") try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: raw = resp.read().decode("utf-8") return json.loads(raw) except urllib.error.HTTPError as e: body = None try: body = e.read().decode("utf-8", errors="replace") except Exception: pass raise PrimError(f"HTTP {e.code} {e.reason}: {body or ''}".strip()) from e except urllib.error.URLError as e: raise PrimError(f"Network error: {e}") from e class PrimClient: def __init__(self, api_key: str | None = None, base_url: str = BASE_URL): self.api_key = api_key or os.environ.get("IDFM_PRIM_API_KEY") if not self.api_key: raise PrimError("Missing IDFM_PRIM_API_KEY env var") self.base_url = base_url.rstrip("/") def get(self, path: str, params: dict | None = None) -> dict: base = f"{self.base_url}/{path.lstrip('/')}" qs = urllib.parse.urlencode(params or {}, doseq=True) url = f"{base}?{qs}" if qs else base return _http_get_json(url, self.api_key) ``` ```python p.add_argument( "--base-url", default=BASE_URL, help="override PRIM base URL (default: %(default)s)", ) sp = p.add_subparsers(dest="cmd", required=True) p_places = sp.add_parser("places", help="resolve places via /places") p_places.add_argument("query") p_places.add_argument("--count", type=int, default=5) p_j = sp.add_parser("journeys", help="plan a journey via /journeys") p_j.add_argument("--from", dest="from_query", required=True) p_j.add_ar ...[truncated 2907 chars]- Remediation
View remediation