T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fns.py:91- Finding
Sensitive credentials and vault data can be transmitted over an insecure or attacker-controlled endpoint
- Content
View full analysis
str: base = base_url.rstrip('/') if not path.startswith('/'): path = '/' + path url = base + path if query: clean = {k: v for k, v in query.items() if v is not None and v != ''} if clean: url += '?' + urllib.parse.urlencode(clean) return url def request_json(method: str, url: str, *, token: Optional[str] = None, payload: Optional[Dict[str, Any]] = None, timeout: int = DEFAULT_TIMEOUT, accept_non_json: bool = False) -> Any: data = None headers = {} if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode('utf-8') headers['Content-Type'] = 'application/json' if token: headers['Authorization'] = token if token.lower().startswith('bearer ') else f'Bearer {token}' req = urllib.request.Request(url=url, data=data, method=method.upper(), headers=headers) ``` The login operation passes credentials and a password to the same unrestricted destination: ```python def cmd_login(args: argparse.Namespace) -> None: cfg = effective_config(args) require(cfg, 'baseUrl', 'credentials', 'password') data = request_json( 'POST', build_url(cfg['baseUrl'], '/user/login'), payload={'credentials': cfg['credentials'], 'password': cfg['password']}, timeout=cfg['timeoutSeconds'], ) ``` ### Technical Analysis The remote network behavior is necessary for the declared Fast Note Sync functionality. However, the implementation accepts an arbitrary `baseUrl` from command-line arguments, environment variables, or configuration files without validating its scheme or destination. Consequently, the client permits plain HTTP ...[truncated 1855 chars]- Remediation
View remediation