T09 · Insecure Skill Coding Practices
Error
- Location
reliable-api-client.js:554- Finding
API Credential Disclosure and SSRF Through Absolute Request URLs
- Content
View full analysis
{ return await this.backoff.retry(async () => { try { return await this.doRequest(url, method, data, entry.key, entry.auth, options); } catch (err) { this.endpointManager.markError(entry.url, this.extractErrorType(err)); throw err; } }); }); ``` ```javascript resolvePath(path, entry, type) { // If a complete URL is supplied, return it directly if (path.startsWith('http')) return path; // Infer the request type from the path if (!type) { if (path.includes('chat')) type = 'chat'; else if (path.includes('completions') && !path.includes('chat')) type = 'completions'; else if (path.includes('embeddings')) type = 'embeddings'; } const paths = entry.paths || this.defaultPaths; const basePath = paths[type] || this.defaultPaths[type] || path; return basePath; } ``` ```javascript doRequest(url, method, data, apiKey, auth, options) { return new Promise((resolve, reject) => { const parsed = new URL(url); const isHttps = parsed.protocol === 'https:'; const client = isHttps ? https : http; const body = data ? (typeof data === 'string' ? data : JSON.stringify(data)) : null; const prefix = auth?.prefix; const authValue = (prefix === '' || prefix == null) ? String(apiKey) : `${String(prefix).trimEnd()} ${apiKey}`; const req = client.request({ hostname: parsed.hostname, port: parsed.port || (isHttps ? 443 : 80), path: parsed.pathname + parsed.sear ...[truncated 2533 chars]- Remediation
View remediation