T09 · Insecure Skill Coding Practices
Error
- Location
scripts/get_token.py:34- Finding
Credentials and sensitive note data can be transmitted to an unrestricted or plaintext destination
- Content
View full analysis
str: """使用用户名密码获取访问令牌""" if base_url is None: base_url = get_base_url() if username is None: username = os.getenv("FLATNOTES_USERNAME") if password is None: password = os.getenv("FLATNOTES_PASSWORD") if not username or not password: print("❌ 错误: FLATNOTES_USERNAME 或 FLATNOTES_PASSWORD 环境变量未设置") print() print("📌 请先配置以下环境变量：") print(" export FLATNOTES_BASE_URL=\"https://your-flatnotes-host\"") print(" export FLATNOTES_USERNAME=\"your-username\"") print(" export FLATNOTES_PASSWORD=\"your-password\"") print() print(" 添加到 ~/.bashrc 后执行: source ~/.bashrc") print(" 或通过 --username 和 --password 参数传入") sys.exit(1) url = f"{base_url}/api/token" data = json.dumps({"username": username, "password": password}).encode("utf-8") req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json", "Content-Length": len(data) }, method="POST" ) try: with urllib.request.urlopen(req) as response: ``` `scripts/create_note.py:34-55`: ```python def get_token_from_credentials(base_url: str) -> str: """使用环境变量中的用户名密码获取令牌""" username = os.getenv("FLATNOTES_USERNAME") password = os.getenv("FLATNOTES_PASSWORD") if not username or not password: print("❌ 错误: 请设置 FLATNOTES_USERNAME 和 FLATNOTES_PASSWORD 环境变量") sys.exit(1) url = f"{base_url}/api/ ...[truncated 4260 chars]- Remediation
View remediation