T09 · Insecure Skill Coding Practices
Warning
- Location
recognize_plate.py:256- Finding
Unrestricted API Endpoint Allows Sensitive Image and Credential Disclosure
- Content
View full analysis
str: """Append the API key to the query string when query-mode auth is enabled.""" if api_key_mode != "query" or not api_key: return api_url parsed = urllib.parse.urlsplit(api_url) query_items = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True) query_items.append((api_key_name, api_key)) updated_query = urllib.parse.urlencode(query_items) return urllib.parse.urlunsplit((parsed.scheme, parsed.netloc, parsed.path, updated_query, parsed.fragment)) def call_api( image_path: Path, api_url: str, api_key: str | None, api_key_mode: str, api_key_name: str, request_json: str | None, file_field: str, request_field: str, timeout_s: float, ) -> Any: """Upload the image to the API and parse the JSON response.""" fields: dict[str, str | bytes] = {} if request_json: fields[request_field] = request_json if api_key_mode == "form" and api_key: fields[api_key_name] = api_key image_bytes = image_path.read_bytes() body, content_type = build_multipart_body( fields, {file_field: (image_path.name, image_bytes, None)}, ) request_url = build_request_url(api_url, api_key, api_key_mode, api_key_name) headers = {"Content-Type": content_type, "Content-Length": str(len(body))} if api_key_mode == "header" and api_key: headers[api_key_name] = api_key elif api_key_mode == "bearer" and api_key: headers["Authorization"] = f"Bearer {api_key}" request = urllib.request.Request(request_url, data=body, headers=headers, method="POST") try: with urllib.request.urlopen(request, timeout=timeou ...[truncated 3388 chars]- Remediation
View remediation