T09 · Insecure Skill Coding Practices
Error
- Location
scripts/arkcloud_common.py:22- Finding
Credentials and Uploaded Data Can Be Sent to an Arbitrary or Insecure Endpoint
- Content
View full analysis
str: return (value or os.environ.get("ARKCLOUD_BASE_URL") or DEFAULT_BASE_URL).rstrip("/") ``` ```python # scripts/arkcloud_upload.py:69-76 def main() -> None: parser = argparse.ArgumentParser(description="Upload a file or folder to ARKCloud IPFS.") parser.add_argument("path", help="File or folder path to upload") parser.add_argument("--folder", action="store_true", help="Upload a folder through the client API") parser.add_argument("--base-url", default=None, help="ARKCloud base URL") args = parser.parse_args() root = base_url(args.base_url) ``` ```python # scripts/arkcloud_upload.py:95-117 payload = request_json( "POST", endpoint(root, "/api/client/upload/folder"), headers={ "Cookie": cookie, "X-CSRF-Token": csrf, "Content-Type": content_type, }, body=body, ) print_json(normalize_result(payload, root)) return token = require_env("ARKCLOUD_UPLOAD_TOKEN") body, content_type = multipart_file("file", target) payload = request_json( "POST", endpoint(root, "/api/upload"), headers={ "Authorization": f"Bearer {token}", "Content-Type": content_type, }, body=body, ) ``` ```python # scripts/arkcloud_list.py:21-24 payload = request_json( "GET", endpoint(base_url(args.base_url), "/api/client/uploads"), headers={"Cookie": cookie}, ) ``` ```pyt ...[truncated 2857 chars]- Remediation
View remediation