T09 · Insecure Skill Coding Practices
Error
- Location
scripts/arbitrage_finder.py:54- Finding
Bearer API credential may be disclosed through unrestricted HTTP redirects
- Content
View full analysis
Dict[str, Any]: url = f"{self.BASE_URL}{path}" if params: qs = urllib.parse.urlencode({k: v for k, v in params.items() if v is not None}) if qs: url = f"{url}?{qs}" headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "User-Agent": "OpenClaw-ArbitrageFinder/1.0", } req = urllib.request.Request(url, headers=headers, method="GET") try: with urllib.request.urlopen(req, timeout=60) as resp: return json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as e: body = e.read().decode("utf-8") try: return json.loads(body) except json.JSONDecodeError: return {"error": {"code": str(e.code), "message": body}} except urllib.error.URLError as e: return {"error": {"code": "NETWORK_ERROR", "message": str(e.reason)}} def _get_multi(self, path: str, params_list: List[Tuple[str, str]]) -> Dict[str, Any]: """GET with repeated query params (e.g. multiple slugs/tickers).""" qs = "&".join(f"{urllib.parse.quote(k)}={urllib.parse.quote(v)}" for k, v in params_list) url = f"{self.BASE_URL}{path}?{qs}" if qs else f"{self.BASE_URL}{path}" headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "User-Agent": "OpenClaw-ArbitrageFinder/1.0", } req = urllib.request.Request(url, headers=headers, method="GET") try: with urllib.request.urlopen(req, timeout=60) as resp: ret ...[truncated 2562 chars]- Remediation
View remediation