T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:753- Finding
Authentication Cookies May Be Disclosed to Unvalidated Article Destinations
- Content
View full analysis
httpx.AsyncClient: return httpx.AsyncClient( headers=base_headers(), cookies=cookies, follow_redirects=True, timeout=httpx.Timeout(30.0, connect=30.0), ) ``` ```python async def download_articles( *, cookies: dict[str, str], articles: list[dict[str, Any]], output_dir: Path, account: dict[str, Any], concurrency: int, ) -> list[dict[str, Any]]: semaphore = asyncio.Semaphore(max(concurrency, 1)) async with build_async_client(cookies) as client: tasks = [ download_single_article( client=client, semaphore=semaphore, index=index, article=article, output_dir=output_dir, account=account, ) for index, article in enumerate(articles, start=1) ] return await asyncio.gather(*tasks) async def download_single_article( *, client: httpx.AsyncClient, semaphore: asyncio.Semaphore, index: int, article: dict[str, Any], output_dir: Path, account: dict[str, Any], ) -> dict[str, Any]: async with semaphore: try: response = await client.get(article["link"]) response.raise_for_status() parsed = parse_article_content(response.text, article) ``` ### Technical Analysis The asynchronous HTTP client is initialized with cookies extracted from the authenticated WeChat browser session. These cookies are supplied as a plain name-to-value dictionary instead of cookie objects with explicit domain and path restrictions. The same authenticated client is then used to request every URL found in `a ...[truncated 1874 chars]- Remediation
View remediation