T09 · Insecure Skill Coding Practices
Error
- Location
scripts/qwencloud_lib.py:271- Finding
Workspace-Controlled API Endpoint Can Receive QwenCloud Credentials
- Content
View full analysis
None: """Load ``.env`` files with proper priority: current dir > repo root.""" load_dotenv(Path.cwd() / ".env") origin = Path(script_file).resolve() if script_file else None if origin: repo = find_repo_root(origin) if repo: load_dotenv(repo / ".env") ``` ```python def native_base_url(self) -> str: custom = os.getenv("QWEN_BASE_URL") region = os.getenv("QWEN_REGION", "ap-southeast-1").lower() if region == "none": if not custom: raise RuntimeError( "QWEN_BASE_URL must be set when QWEN_REGION=none." ) return custom.rstrip("/") if custom: parsed = urllib.parse.urlparse(custom.rstrip("/")) return f"{parsed.scheme}://{parsed.netloc}/api/v1" return self._NATIVE_BASE.get(region, self._NATIVE_BASE["ap-southeast-1"]) ``` ```python def make_headers( self, api_key: str, payload: Any = None, ) -> dict[str, str]: hdrs: dict[str, str] = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } if payload and self.has_managed_url(payload): hdrs["X-DashScope-OssResourceResolve"] = "enable" source_cfg = build_source_config() if source_cfg: hdrs["X-DashScope-Source-Config"] = source_cfg return hdrs ``` ```python load_env(script_file) provider = get_provider() fallback_env = provider.get_api_key_env_name() key = os.environ.get("QWEN_API_KEY", "").strip() if not key: key = os.environ.get(fallback_env, "").strip() ``` `` ...[truncated 2577 chars]- Remediation
View remediation