T09 · Insecure Skill Coding Practices
Error
- Location
src/config.js:4- Finding
Bearer Token Exposure Through Arbitrary or Plaintext RPC Endpoints
- Content
View full analysis
0) { const err = new Error(`缺少必要环境变量: ${missing.join(", ")}`); err.code = "missing_config"; throw err; } let parsedUrl; try { parsedUrl = new URL(baseUrl); } catch { const err = new Error("FTTRAI_RPC_URL 不是有效 URL"); err.code = "invalid_config"; throw err; } if (!["http:", "https:"].includes(parsedUrl.protocol)) { const err = new Error("FTTRAI_RPC_URL 只支持 http 或 https"); err.code = "invalid_config"; throw err; } ``` From `src/connect.js:8-25`: ```js async unary(procedure, body = {}) { const url = `${this.config.baseUrl}${procedure}`; let lastError; for (let attempt = 0; attempt <= this.config.maxRetries; attempt += 1) { const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), this.config.timeoutMs); try { const response = await fetch(url, { method: "POST", headers: { "Authorization": `Bearer ${this.config.token}`, "Content-Type": "application/json", "Accept": "application/json", }, body: JSON.stringify(body), signal: controller.signal, }); ``` ### Technical Analysis The configurable `FTTRAI_RPC_URL` accepts both HTTP and HTTPS URLs and does n ...[truncated 2965 chars]- Remediation
View remediation