T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clash-verge.py:145- Finding
Controller Credential Exposure Through Command-Line Arguments and Unrestricted Plaintext HTTP
- Content
View full analysis
= 400: print(f"API error {resp.status}: {raw.decode(errors='replace')}", file=sys.stderr) sys.exit(1) return json.loads(raw) if raw.strip() else {} else: url = http_url.rstrip("/") + path data = json.dumps(body).encode() if body else None req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=10) as resp: raw = resp.read() return json.loads(raw) if raw.strip() else {} ``` The controller URL and secret may also be supplied directly on the command line: ```python p.add_argument("--sock", help=f"Unix socket path (default: {DEFAULT_SOCK})") p.add_argument("--api", help=f"HTTP API URL (default: {DEFAULT_HTTP})") p.add_argument("--secret", help="API secret") ``` ```python # Override env from CLI args import os if args.sock: os.environ["CLASH_SOCK"] = args.sock if args.api: os.environ["CLASH_API"] = args.api if args.secret: os.environ["CLASH_SECRET"] = args.secret ``` ### Technical Analysis The `--secret` option places the mihomo controller credential in th ...[truncated 2780 chars]- Remediation
View remediation