T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert-to-pdf.py:46- Finding
Unrestricted Base URL Override Can Disclose Documents and API Credentials
- Content
View full analysis
Dict[str, Any]: url = base_url.rstrip("/") + CREATE_PATH headers = make_headers(api_key) # multipart/form-data with multiple files under the SAME key: "files" files: List[Tuple[str, Tuple[str, Any, str]]] = [] opened = [] # We don't enforce input mime types; use octet-stream for broad compatibility. try: for p in file_paths: f = open(p, "rb") opened.append(f) files.append(("files", (os.path.basename(p), f, "application/octet-stream"))) resp = requests.post(url, headers=headers, files=files, timeout=timeout_s) ``` ```python def get_job( base_url: str, api_key: str, job_id: Any, timeout_s: int = 30, ) -> Dict[str, Any]: url = base_url.rstrip("/") + f"/api/{job_id}" headers = make_headers(api_key) resp = requests.get(url, headers=headers, timeout=timeout_s) ``` ```python ap.add_argument( "--base-url", default=os.getenv("SOLUTIONS_BASE_URL", DEFAULT_BASE_URL), help="Base URL override", ) ``` ### Technical Analysis The conversion workflow legitimately requires transmitting selected documents and a Bearer API key to the documented Solutions API. However, the destination is configurable through both the `--base-url` command-line argument and the `SOLUTIONS_BASE_URL` environment variable. The supplied URL is used without validation of its scheme, hostname, port, or relationship to the expected API domain. Consequently, it may reference: - An attacker-controlled HTTPS server. - A plaintext HTTP endpoint, exposing data to network interception. - An unexpected internal service reachable from ...[truncated 2436 chars]- Remediation
View remediation