T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chat.py:107- Finding
Bearer Credential and Clinical Data Exposure Through Unrestricted Redirect Handling
- Content
View full analysis
urllib_request.Request: payload = json.dumps(body, ensure_ascii=False).encode("utf-8") return urllib_request.Request( CHAT_COMPLETIONS_URL, data=payload, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "Accept": "application/json, text/event-stream", }, method="POST", ) ``` The authenticated request is subsequently passed to `urlopen`, which uses Python's default redirect handling: ```python def call_api(body: dict, *, timeout: int = DEFAULT_TIMEOUT_SECONDS) -> Tuple[dict, Optional[str], float]: api_key = require_api_key() request = make_request(body, api_key) started = time.monotonic() try: with urllib_request.urlopen(request, timeout=timeout) as response: payload, request_id = load_json_response(response) ``` The streaming path has the same behavior: ```python def call_stream(body: dict, *, timeout: int = DEFAULT_TIMEOUT_SECONDS) -> Tuple[Optional[str], float]: api_key = require_api_key() request = make_request(body, api_key) started = time.monotonic() try: with urllib_request.urlopen(request, timeout=timeout) as response: request_id = request_id_from_headers(response.headers) raw = response.read() ``` ### Technical Analysis The helper correctly targets a fixed HTTPS endpoint and the transmission of the query and API credential is necessary for the declared API-backed functionality. However, `urllib.request.urlopen` installs default redirect processing, while the implementation does not explicitly reject re ...[truncated 2688 chars]- Remediation
View remediation