T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aisearch.py:193- Finding
Bearer Credential and Sensitive Request Data Can Be Redirected to an Arbitrary Host
- Content
View full analysis
Dict[str, str]: headers = { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", "Accept": accept, } if self.extra_headers: headers.update(self.extra_headers) return headers def _post_json(self, path: str, payload: Dict[str, Any]) -> Any: url = f"{self.base_url}{path}" headers = self._headers(accept="application/json") try: resp = requests.post(url, headers=headers, json=payload, timeout=self.timeout) except requests.exceptions.RequestException as e: raise RuntimeError(str(e)) from e ``` ```python def _post_stream(self, path: str, payload: Dict[str, Any]) -> requests.Response: url = f"{self.base_url}{path}" headers = self._headers(accept="text/event-stream") try: resp = requests.post( url, headers=headers, json=payload, stream=True, timeout=self.timeout, ) ``` ```python parser.add_argument("--base-url", default="", help="覆盖 VIKING_AISEARCH_API_BASE") parser.add_argument("--api-key", default="", help="覆盖 VIKING_AISEARCH_API_KEY") ``` ### Technical Analysis The destination base URL is accepted from either a command-line argument or an environment variable without validating its scheme, hostname, port, or relationship to the documented Volcengine service. The same client then attaches the Viking AI Search bearer credential to requests sent to that destination. The implementation do ...[truncated 2183 chars]- Remediation
View remediation