T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bona_movie_production.py:189- Finding
Credential and bearer-token disclosure through unrestricted endpoint overrides
- Content
View full analysis
str: if not self.api_key: raise RuntimeError("api_key is required for login") response = requests.post( self.login_url, headers={"Content-Type": "application/json"}, json={"accessKey": self.api_key}, timeout=self.timeout, ) payload = self._parse_response(response) data = payload.get("data") if isinstance(payload, dict) else None access_token = data.get("access_token") if isinstance(data, dict) else None if not access_token: raise RuntimeError( f"login response missing access_token: {json.dumps(payload, ensure_ascii=False, indent=2)}") return str(access_token) def _get_access_token(self) -> str: if not self._access_token: self._access_token = self._login() return self._access_token @property def headers(self) -> Dict[str, str]: return { "Content-Type": "application/json", "Authorization": f"Bearer {self._get_access_token()}", "Clientid": "e5cd7e4891bf95d1d19206ce24a7b32e", } def create_image_task(self, payload: Dict[str, Any]) -> Dict[str, Any]: response = requests.post(f"{self.base_url}/image", headers=self.headers, json=payload, timeout=self.timeout) return self._parse_response(response) def create_video_task(self, payload: Dict[str, Any]) -> Dict[str, Any]: response = requests.post(f"{self.base_url}/video", headers=self.headers, json=payload, timeout=self.timeout) return self._parse_response(response) ``` ```python def add_client_args(parser: argparse.ArgumentParser) -> None: parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--login-url", default=DEFAULT_LOGIN_URL) parser.add_argument("--api-key", de ...[truncated 2348 chars]- Remediation
View remediation