T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crm_postgrid_mailer.py:217- Finding
Arbitrary CRM Base URLs Receive GHL or FUB Credentials
- Content
View full analysis
List[Dict[str, Any]]: api_key = args.api_key or os.getenv("GHL_API_KEY") if not api_key: raise MailerError("Missing GHL API key. Set GHL_API_KEY or pass --api-key.") base_url = (args.base_url or os.getenv("GHL_BASE_URL") or DEFAULT_GHL_BASE_URL).rstrip("/") query: Dict[str, Any] = {"limit": args.limit} if args.location_id: query["locationId"] = args.location_id url = f"{base_url}/contacts/?{urllib.parse.urlencode(query)}" headers = { "Accept": "application/json", "Authorization": f"Bearer {api_key}", "Version": args.ghl_version, } payload = _http_json("GET", url, headers=headers, timeout=args.timeout) contacts = _extract_ghl_contacts(payload) return [_normalize_contact(item, "ghl") for item in contacts] def fetch_contacts_from_fub(args: argparse.Namespace) -> List[Dict[str, Any]]: api_key = args.api_key or os.getenv("FUB_API_KEY") if not api_key: raise MailerError("Missing FUB API key. Set FUB_API_KEY or pass --api-key.") base_url = (args.base_url or os.getenv("FUB_BASE_URL") or DEFAULT_FUB_BASE_URL).rstrip("/") auth_header = base64.b64encode(f"{api_key}:".encode("utf-8")).decode("ascii") query = {"limit": args.limit} url = f"{base_url}/people?{urllib.parse.urlencode(query)}" headers = { "Accept": "application/json", "Authorization": f"Basic {auth_header}", } payload = _http_json("GET", url, headers=headers, timeout=args.timeout) people = _extract_fub_people(payload) return [_normalize_contact(item, "fub") for item in people] ``` The desti ...[truncated 1915 chars]- Remediation
View remediation