T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bona_movie_production.py:189- Finding
Credential Disclosure Through Unrestricted API Endpoint Overrides
- Content
View full analysis
str: if not self.api_key: raise RuntimeError("api_key is required for login") response = requests.post( self.login_url, headers={"Content-Type": "application/json"}, json={"accessKey": self.api_key}, timeout=self.timeout, ) payload = self._parse_response(response) data = payload.get("data") if isinstance(payload, dict) else None access_token = data.get("access_token") if isinstance(data, dict) else None if not access_token: raise RuntimeError( f"login response missing access_token: {json.dumps(payload, ensure_ascii=False, indent=2)}") return str(access_token) def _get_access_token(self) -> str: if not self._access_token: self._access_token = self._login() return self._access_token @property def headers(self) -> Dict[str, str]: return { "Content-Type": "application/json", "Authorization": f"Bearer {self._get_access_token()}", "Clientid": "e5cd7e4891bf95d1d19206ce24a7b32e", } def create_image_task(self, payload: Dict[str, Any]) -> Dict[str, Any]: response = requests.post(f"{self.base_url}/image", headers=self.headers, json=payload, timeout=self.timeout) return self._parse_response(response) def create_video_task(self, payload: Dict[str, Any]) -> Dict[str, Any]: response = requests.post(f"{self.base_url}/video", headers=self.headers, json=payload, timeout=self.timeout) return self._parse_response(response) def query_task( self, task_id: str, thread_id: Optional[str] = None, model_name: Optional[str] = None, ) -> Dict[str, Any]: params: Dict[str, str] = {} if thread_id: params["thread_id"] = th ...[truncated 3310 chars]- Remediation
View remediation