T09 · Insecure Skill Coding Practices
Error
- Location
compensation-damages-calculator/scripts/policy_data.py:83- Finding
Authenticated Policy Requests Can Be Redirected to an Arbitrary Destination
- Content
View full analysis
str: return os.getenv( "COMPENSATION_DAMAGES_POLICY_API_URL", DEFAULT_POLICY_API_URL, ).strip() def build_api_request(payload: dict[str, Any], apikey: str) -> urllib.request.Request: request_payload = request_payload_from_input(payload) request_body = {"resource_type": RESOURCE_TYPE, "payload": request_payload} return urllib.request.Request( policy_api_url(), data=json.dumps(request_body, ensure_ascii=False).encode("utf-8"), headers={ "Content-Type": "application/json", "Authorization": authorization_header(apikey), **REQUEST_CONTEXT.headers, }, method="POST", ) def read_api_response(request: urllib.request.Request) -> dict[str, Any]: try: with urllib.request.urlopen(request, timeout=15) as response: data = json.loads(response.read().decode("utf-8")) ``` `overtime-pay-calculator/scripts/policy_data.py`: ```python def policy_api_url() -> str: return os.getenv("OVERTIME_POLICY_API_URL", DEFAULT_POLICY_API_URL).strip() ``` `work-injury-compensation-calculator/scripts/policy_data.py`: ```python def policy_api_url() -> str: return os.getenv("WORK_INJURY_POLICY_API_URL", DEFAULT_POLICY_API_URL).strip() ``` The latter two modules use the same request construction pattern, including the Bearer API key and `REQUEST_CONTEXT` headers. ### Technical Analysis Network access is relevant to the declared functionality because th ...[truncated 2341 chars]- Remediation
View remediation