T09 · Insecure Skill Coding Practices
Warning
- Location
novada_search.py:399- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
dict: """Call Novada search endpoint. Supports all 9 engines + Google sub-types.""" key = load_key() if not key: raise NovadaConfigError( "Missing NOVADA_API_KEY. Set env var, pass --api-key, or add NOVADA_API_KEY to a local .env" ) query_param = ENGINE_QUERY_PARAM.get(engine, "q") params = { "engine": engine, query_param: query, "api_key": key, "fetch_mode": fetch_mode, "num": str(max_results), } # Yelp needs a location parameter if not embedded in query if engine == "yelp": params["find_loc"] = "" # let provider auto-detect / use query context # Add Google sub-type if applicable if engine == "google" and google_type and google_type != "search": params["google_type"] = google_type url = NOVADA_SEARCH_URL + "?" + urllib.parse.urlencode(params) ``` The extraction path repeats the same pattern at lines 441-454: ```python params = { "engine": "google", "q": "", "url": url_to_extract, "api_key": key, "fetch_mode": fetch_mode, "extract_mode": "content", } url = NOVADA_SEARCH_URL + "?" + urllib.parse.urlencode(params) ``` ### Technical Analysis The Novada API key is required for the Skill's declared search and extraction functionality, and transmitting it to the declared Novada endpoint is expected. However, placing the credential in the URL query string is not the minimum-risk authentication mechanism. URLs are frequently recorded in locations that HTTP headers and request bodies are not, including: - Reverse-proxy and API-gateway acc ...[truncated 1889 chars]- Remediation
View remediation