T09 · Insecure Skill Coding Practices
Error
- Location
scripts/common.py:51- Finding
Arbitrary Endpoint Override Can Expose the API Key and Source Document
- Content
View full analysis
None: self.skill_name = skill_name self.base_url = os.environ.get("GOAI_BASE_URL", DEFAULT_BASE_URL).rstrip("/") self.api_key = os.environ.get("GOAI_API_KEY", "") ``` ```python def _headers(self, auth_mode: str) -> dict[str, str]: headers = {"Accept": "application/json"} if auth_mode == "auth": headers["Authorization"] = f"Bearer {self.api_key}" return headers ``` ```python def upload_local_file(self, value: str) -> str: path = Path(value).expanduser() if not path.is_absolute(): path = (Path.cwd() / path).resolve() if not path.is_file(): raise GoAIError(f"local file not found or unreadable: {value}") mime_type = content_type_for_file(path) payload = self.json_request( "GET", f"{self.base_url}/api/v2/oss/sign-url", "auth", query={ "filename": path.name, "contentType": mime_type, "folder": "inputs", }, ) self.api_assert_ok(payload) data = payload.get("data") if not isinstance(data, dict): raise GoAIError("invalid upload response") signed_url = str(data.get("signedUrl") or "") final_url = str(data.get("finalUrl") or "") if not signed_url: raise GoAIError("signedUrl missing from upload response") if not final_url: raise GoAIError("finalUrl missing from upload response") try: response = self._http.put( signed_url, headers={"Content-Type": mime_type}, content=path.read_bytes(), ) ``` ### Technical Analysis `GOAI_BASE_URL` is accepted from the environment ...[truncated 1706 chars]- Remediation
View remediation