T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_auth.py:18- Finding
Environment-Controlled API Base URL Can Redirect Credentials and Access Tokens
- Content
View full analysis
str: return ( os.environ.get("CHANJING_OPENAPI_BASE_URL") or os.environ.get("CHANJING_API_BASE") or _DEFAULT_OPENAPI_BASE ).rstrip("/") ``` ```python url = API_BASE + "/open/v1/access_token" req = urllib.request.Request( url, data=json.dumps({"app_id": app_id, "secret_key": secret_key}).encode("utf-8"), headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) except Exception as e: return None, str(e) ``` The remaining scripts similarly construct requests from the environment-controlled `API_BASE` and attach the access token: ```python url = f"{API_BASE}/open/v1/video_lip_sync/create" req = urllib.request.Request( url, data=json.dumps(body).encode("utf-8"), headers={"access_token": token, "Content-Type": "application/json"}, method="POST", ) ``` ### Technical Analysis The API base URL can be replaced through either `CHANJING_OPENAPI_BASE_URL` or the legacy `CHANJING_API_BASE` variable. The code applies only `rstrip("/")`; it does not require HTTPS or verify that the destination hostname is `open-api.chanjing.cc`. When the cached token is absent or close to expiration, `_auth.py` sends the long-lived `app_id` and `secret_key` to the configured endpoint. The other scripts attach the access token to requests sent through the same configurable base URL. This behavior conflicts with the intended network allowlist in `manifest.yaml`, which documents Chanjing hosts rather than arbitrary ...[truncated 1229 chars]- Remediation
View remediation