T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build_monitor_config.py:175- Finding
Proxy Credentials Exposed in Generated Configuration Output
- Content
View full analysis
dict: if args.network_path == "direct": return { "enabled": False, "mode": "direct", "reason": "default_direct_path", } if args.proxy_url: endpoint = args.proxy_url.strip() else: if not (args.proxy_username and args.proxy_password): raise ValueError( "residential_proxy 模式下，若未提供 --proxy-url，则必须提供 --proxy-username 和 --proxy-password" ) endpoint = ( f"http://{args.proxy_username}:{args.proxy_password}@" f"{args.proxy_host}:{args.proxy_port}" ) return { "enabled": True, "mode": "residential_proxy", "endpoint": endpoint, "host": args.proxy_host, "port": args.proxy_port, "rotate_per_request": args.proxy_rotate_per_request, "session_id": args.proxy_session_id, "geo": { "country": args.proxy_country, "state": args.proxy_state, "city": args.proxy_city, "zip": args.proxy_zip, }, } ``` The returned object is subsequently embedded in the generated payload and printed: ```python "network": { "path": args.network_path, "proxy": build_proxy_config(args), "akamai_block_recovery": { "enabled": args.network_path == "residential_proxy", "notes": [ "If direct path returns HTTP 403 Access Denied, switch to residential proxy.", "Use sticky session when product page requires multi-step render and cart checks.", ], }, }, ``` ```python if args.output_format == "json": print(json.dumps ...[truncated 2190 chars]- Remediation
View remediation