T09 · Insecure Skill Coding Practices
Error
- Location
scripts/finxdata_simtrading.py:57- Finding
Unrestricted Base URL Allows Disclosure of the Privileged Trading Key
- Content
View full analysis
Any: if not self.trading_key: raise FinXDataClientError( "缺少模拟交易 Key，请设置 FINXDATA_TRADING_KEY", code="MISSING_TRADING_KEY", ) params = { key: _query_value(value) for key, value in (query or {}).items() if value is not None } url = f"{self.base_url}{path}" if params: url = f"{url}?{urllib.parse.urlencode(params)}" data = None headers = { "Accept": "application/json", "User-Agent": DEFAULT_USER_AGENT, "X-FINXDATA-TRADING-KEY": self.trading_key, } ``` ### Technical Analysis The client obtains its API destination from the `base_url` constructor argument, `FINXDATA_BASE_URL`, or the legacy `FINDATA_BASE_URL` environment variable. It performs no validation of the resulting URL before attaching the privileged `X-FINXDATA-TRADING-KEY` header. In particular, the implementation does not: - Require the HTTPS scheme. - Verify that the destination host is an approved FinXData host. - Reject embedded URL credentials, unexpected ports, or malformed endpoint components. - Establish a trust relationship between a custom endpoint and the credential being transmitted. - Explicitly prevent credential forwarding during cros ...[truncated 1765 chars]- Remediation
View remediation