T09 · Insecure Skill Coding Practices
Error
- Location
scripts/larksync_wsl_helper.py:122- Finding
Automatic WSL Endpoint Trust Can Expose Sensitive Synchronization Data
- Content
View full analysis
list[tuple[str, str]]: pairs: list[tuple[str, str]] = [ ("localhost", f"http://localhost:{port}"), ("loopback-ipv4", f"http://127.0.0.1:{port}"), ("docker-host-alias", f"http://host.docker.internal:{port}"), ] gateway = _read_default_gateway() if gateway: pairs.append(("default-gateway", f"http://{gateway}:{port}")) for index, ns in enumerate(_read_resolv_nameservers(), start=1): pairs.append((f"resolv-nameserver-{index}", f"http://{ns}:{port}")) ``` ```python def _probe_single(name: str, base_url: str, timeout: float = DEFAULT_TIMEOUT) -> ProbeResult: parsed = urlparse(base_url) host = parsed.hostname or "" port = parsed.port or 80 connect_ok = False health_ok = False status: int | None = None error_text: str | None = None start = time.perf_counter() try: with socket.create_connection((host, port), timeout=timeout): connect_ok = True health_url = f"{base_url.rstrip('/')}{HEALTH_PATH}" req = request.Request(health_url, headers={"Accept": "application/json"}, method="GET") with request.urlopen(req, timeout=timeout) as resp: status = int(resp.getcode()) health_ok = status == 200 ``` ```python def select_reachable_base_url(results: Iterable[ProbeResult]) -> str | None: for item in results: if item.health_ok: return item.base_url return None ``` ```python def ensure_remote_allow_flag(args: list[str]) -> list[str]: base_url = _extract_base_url(args) if not base_url: ...[truncated 4239 chars]- Remediation
View remediation