T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wakapi_query.py:47- Finding
Wakapi API Key May Be Transmitted over Plaintext HTTP
- Content
View full analysis
str: u = url.strip().rstrip("/") if not u: raise SystemExit( "WAKAPI_URL is required for the Wakapi skill. " "Example: export WAKAPI_URL=https://wakapi.example.com" ) return u ``` ```python def _auth_basic_value(api_key: str) -> str: if not api_key: raise SystemExit("WAKAPI_API_KEY is empty") b64 = base64.b64encode(api_key.encode("utf-8")).decode("ascii") return f"Basic {b64}" def _request_headers() -> dict[str, str]: key = os.environ.get("WAKAPI_API_KEY", "") if not key: raise SystemExit("WAKAPI_API_KEY is empty") return {"Authorization": _auth_basic_value(key), "Accept": "application/json"} def _get_json( url: str, headers: dict[str, str], *, timeout: float | None = None, ) -> tuple[int, Any]: t = _resolve_http_timeout(cli_sec=timeout, fallback_sec=60) _log_request("GET", url) req = urllib.request.Request(url, method="GET", headers=headers) try: with urllib.request.urlopen(req, timeout=t) as resp: body = resp.read().decode("utf-8") ``` The project documentation explicitly permits plaintext HTTP: ```markdown | **Network** | Outbound **HTTPS** (or `http://` if your instance uses it) to **`WAKAPI_URL`**. | ``` ### Technical Analysis The URL normalization routine only removes surrounding whitespace and trailing slashes. It does not parse the URL or enforce HTTPS before authenticated requests are made. Authenticated subcommands read `WAKAPI_API_KEY`, encode it using Base64, and place it directly in an HTTP Basic Authorization header. Base64 provides no confidentiality and can be ...[truncated 1794 chars]- Remediation
View remediation