T09 · Insecure Skill Coding Practices
Error
- Location
scripts/opencode_client.py:18- Finding
Unauthenticated Plaintext Transport for Privileged OpenCode API Operations
- Content
View full analysis
dict: url = f"{self.base_url}{path}" headers = {"Content-Type": "application/json"} req = urllib.request.Request( url, method=method, headers=headers, data=json.dumps(data).encode() if data else None ) # 配置代理 if self.proxy: proxy_handler = urllib.request.ProxyHandler({ 'http': self.proxy, 'https': self.proxy }) opener = urllib.request.build_opener(proxy_handler) urllib.request.install_opener(opener) try: with urllib.request.urlopen(req) as response: return json.loads(response.read().decode()) except urllib.error.HTTPError as e: return {"error": f"HTTP {e.code}: {e.reason}", "details": e.read().decode()} except Exception as e: return {"error": str(e)} ``` The client also exposes privileged server-side operations, including arbitrary shell-command requests: ```python def shell_command(self, session_id: str, command: str) -> dict: """在 session 中执行 shell 命令""" return self._request("POST", f"/session/{session_id}/shell", {"command": command}) ``` ### Technical Analysis The request layer only sends a `Content-Type` header. It provides no bearer token, API key, client certificate, request signature, or other authentication mechanism. It also accepts arbitrary base URLs without requiring HTTPS. The project docu ...[truncated 2247 chars]- Remediation
View remediation