T09 · Insecure Skill Coding Practices
Error
- Location
scripts/alist_client.py:21- Finding
Administrative credentials may be transmitted over unencrypted HTTP
- Content
View full analysis
dict: url = f"{self.base_url}{path}" headers = {"Content-Type": "application/json"} if self.api_key: headers["Authorization"] = self.api_key else: token = self._get_token() if token: headers["Authorization"] = token body = None if data is not None: body = json.dumps(data).encode("utf-8") if params: qs = urllib.parse.urlencode(params) url = f"{url}?{qs}" last_error = None for attempt in range(self.retries + 1): try: req = urllib.request.Request(url, data=body, headers=headers, method=method) with urllib.request.urlopen(req, timeout=self.timeout) as resp: raw = resp.read().decode("utf-8") ``` The documented examples also use plaintext HTTP: ```bash python scripts/alist_client.py --base-url http://localhost:80 --username admin --password xxx ping python scripts/alist_client.py --base-url http://localhost:80 --api-key "your-key" list /mnt/sda2 ``` ### Technical Analysis The client accepts arbitrary `base_url` values and defaults to an `http://` URL. It does not reject or warn about plaintext HTTP before placing an API key or bearer token in the `Authorization` header. The login flow similarly transmits a password-derived authentication value to the configured endpoint. Plaintext use on loopback may be acceptable in a narrowly controlled deployment, but the same unrestricted configuration supports non-loopback HTTP destinations. On an untrusted network, an observer, ma ...[truncated 1403 chars]- Remediation
View remediation