T09 · Insecure Skill Coding Practices
Error
- Location
scripts/license_gate.py:21- Finding
License Credentials and Machine Fingerprints Transmitted over Plaintext HTTP
- Content
View full analysis
dict[str, Any]: body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: text = resp.read().decode("utf-8") data = json.loads(text or "{}") return data if isinstance(data, dict) else {} ``` ```python def _remote_activate(card_key: str, machine_fp: str) -> dict[str, Any]: if not LICENSE_SERVER_URL: raise LicenseError("未配置授权服务器地址，请设置环境变量 TMO_LICENSE_SERVER。") url = f"{LICENSE_SERVER_URL}/api/activate" data = _http_post_json(url, {"card_key": card_key, "machine_fp": machine_fp}) if (data.get("status") or "").lower() != "ok": msg = str(data.get("message") or "卡密激活失败，请确认卡密是否正确或联系卖家。") raise LicenseError(msg) return data def _remote_check(machine_fp: str, card_key: str | None = None) -> dict[str, Any]: if not LICENSE_SERVER_URL: raise LicenseError("未配置授权服务器地址，请设置环境变量 TMO_LICENSE_SERVER。") url = f"{LICENSE_SERVER_URL}/api/check" payload: dict[str, Any] = {"machine_fp": machine_fp} if card_key: payload["card_key"] = card_key data = _http_post_json(url, payload) if (data.get("status") or "").lower() != "ok": msg = str(data ...[truncated 1774 chars]- Remediation
View remediation