T09 · Insecure Skill Coding Practices
Error
- Location
scripts/validate_config.py:173- Finding
Bearer Credential Disclosure and SSRF Through an Untrusted Custom Endpoint
- Content
View full analysis
Tuple[bool, str]: """Validate the base URL from foxcode provider.""" providers = config.get("models", {}).get("providers", {}) foxcode = providers.get("foxcode", {}) base_url = foxcode.get("baseUrl", "") if not base_url: return False, "baseUrl is empty" if base_url not in VALID_ENDPOINTS: # Check if it's a valid URL format if not re.match(r'^https?://[^\s/]+', base_url): return False, f"Invalid URL format: {base_url}" # It's a custom URL, just warn return True, f"Custom endpoint (not in known list): {base_url}" return True, f"Valid endpoint: {base_url}" ``` ```python def test_endpoint_connection(config: Dict) -> Tuple[bool, str]: """Test connection to the foxcode endpoint.""" providers = config.get("models", {}).get("providers", {}) foxcode = providers.get("foxcode", {}) base_url = foxcode.get("baseUrl", "") api_key = foxcode.get("apiKey", "") # Resolve environment variable if needed if api_key.startswith("${") and api_key.endswith("}"): env_var = api_key[2:-1] api_key = os.environ.get(env_var, "") if not api_key: return False, f"Cannot test: environment variable {env_var} not set" try: req = Request(base_url, method="HEAD") req.add_header("Authorization", f"Bearer {api_key}") req.add_header("User-Agent", "Foxcode-Validator/1.0") with urlopen(req, timeout=15) as response: return True, f"Connection successful (status: {response.getcode()})" ``` ### Technical Analysis The validator treats any string matching a basic HTTP or HTTPS URL expression as an accep ...[truncated 2435 chars]- Remediation
View remediation