T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_auth.py:20- Finding
Credentials and Access Tokens Can Be Transmitted to an Unrestricted Environment-Controlled Endpoint
- Content
View full analysis
str: return ( os.environ.get("CHANJING_OPENAPI_BASE_URL") or os.environ.get("CHANJING_API_BASE") or _DEFAULT_OPENAPI_BASE ).rstrip("/") ``` ```python url = API_BASE + "/open/v1/access_token" req = urllib.request.Request( url, data=json.dumps({"app_id": app_id, "secret_key": secret_key}).encode("utf-8"), headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) ``` The same unrestricted base URL is used when sending access tokens: ```python API_BASE = (__import__("os").environ.get("CHANJING_OPENAPI_BASE_URL") or __import__("os").environ.get("CHANJING_API_BASE") or "https://open-api.chanjing.cc").rstrip("/") ``` ```python def api_get(token, path, query=None): query = query or {} suffix = "" if query: suffix = "?" + urllib.parse.urlencode(query, doseq=True) req = urllib.request.Request( f"{API_BASE}{path}{suffix}", headers={"access_token": token}, method="GET", ) with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) ``` ```python def api_post(token, path, payload): req = urllib.request.Request( f"{API_BASE}{path}", data=json.dumps(payload).encode("utf-8"), headers={"access_token": token, "Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The manifest declares `open-api.chanjing.cc` as an allowed network host, but the implementatio ...[truncated 2087 chars]- Remediation
View remediation