T09 · Insecure Skill Coding Practices
Error
- Location
src/config.js:4- Finding
Operator bearer token can be transmitted to an arbitrary or plaintext endpoint
- Content
View full analysis
0) { const err = new Error(`缺少必要环境变量: ${missing.join(", ")}`); err.code = "missing_config"; throw err; } let parsedUrl; try { parsedUrl = new URL(baseUrl); } catch { const err = new Error("FTTRAI_RPC_URL 不是有效 URL"); err.code = "invalid_config"; throw err; } if (!["http:", "https:"].includes(parsedUrl.protocol)) { const err = new Error("FTTRAI_RPC_URL 只支持 http 或 https"); err.code = "invalid_config"; throw err; } ``` From `src/connect.js`: ```js async unary(procedure, body = {}) { const url = `${this.config.baseUrl}${procedure}`; let lastError; for (let attempt = 0; attempt <= this.config.maxRetries; attempt += 1) { const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), this.config.timeoutMs); try { const response = await fetch(url, { method: "POST", headers: { "Authorization": `Bearer ${this.config.token}`, "Content-Type": "application/json", "Accept": "application/json", }, body: JSON.stringify(body), signal: controller.signal, }); ``` ### Technical Analysis The configurable `FTTRAI_RPC_URL` is validated only as an HTTP or HTTPS URL. No check requires TLS, restrict ...[truncated 2497 chars]- Remediation
View remediation