T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deskbird_tool.py:2363- Finding
Stored authentication credentials can be transmitted to arbitrary network destinations
- Content
View full analysis
str: return os.getenv("DESKBIRD_BASE_URL", "https://api.deskbird.com").rstrip("/") ``` ```python elif key_l in {"deskbird_base_url", "base_url", "baseurl"}: out["DESKBIRD_BASE_URL"] = val.rstrip("/") ``` ```python if args.base_url: values["DESKBIRD_BASE_URL"] = str(args.base_url).strip().rstrip("/") ``` ```python def cmd_replay(args: argparse.Namespace) -> int: load_dotenv(args.env_file, override=False) data = read_json(Path(args.file)) records = data.get("records", []) if not records: print("Keine Records in Capture-Datei vorhanden.") return 1 rec = pick_record(records, args.id) method = rec.get("method", "GET") url = rec.get("url", "") req = rec.get("request", {}) captured_headers = req.get("headers", {}) or {} body = req.get("body", None) if args.override_json: body = read_json(Path(args.override_json)) auth_headers = build_auth_headers_from_env() headers = prepare_headers_for_replay(captured_headers, auth_headers) if args.dry_run: print("Dry-Run aktiv, es wird kein API-Call ausgefuehrt.") print(f"Method: {method}") print(f"URL: {url}") print("Header:") for key, value in headers.items(): safe_val = redact_value(value) if looks_secret_header(key) else value print(f" {key}: {safe_val}") print("Body:") print(json.dumps(body, indent=2, ensure_ascii=True) if isinstance(body, (dict, list)) else body) return 0 response = perform_request(method, url, headers, body, args.timeout) print_response_summary(response, max_chars=args.max_body_chars) return 0 ``` ```python de ...[truncated 4262 chars]- Remediation
View remediation