T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ima_video_create.py:1287- Finding
Configurable API Endpoint Can Redirect Bearer Credentials to an Arbitrary Host
- Content
View full analysis
dict: return { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "x-app-source": "ima_skills", "x_app_language": language, } ``` ```python def get_product_list(base_url: str, api_key: str, category: str, app: str = "ima", platform: str = "web", language: str = "en") -> list: url = f"{base_url}/open/v1/product/list" params = {"app": app, "platform": platform, "category": category} headers = make_headers(api_key, language) resp = requests.get(url, params=params, headers=headers, timeout=30) ``` ```python p.add_argument("--base-url", default=DEFAULT_BASE_URL, help="API base URL") ``` ```python def main(): args = build_parser().parse_args() base = args.base_url apikey = args.api_key or os.getenv("IMA_API_KEY") tree = get_product_list(base, apikey, args.task_type, language=args.language) ``` The image-upload destination is similarly configurable: ```python if args.input_images: im_base = os.getenv("IMA_IM_BASE_URL", DEFAULT_IM_BASE_URL) for i, img_source in enumerate(args.input_images, 1): img_url = prepare_image_url(img_source, apikey, im_base) ``` ### Technical Analysis The `--base-url` argument is accepted without validating its scheme or hostname. Requests to this destination contain the IMA API key in the `Authorization` header. Consequently, anyone who can influence the script invocation can direct the bearer credential to an arbitrary server. The image-upload token service has the same problem through `IMA_IM_BASE_URL`. That request sends th ...[truncated 1458 chars]- Remediation
View remediation