T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_api_test.py:90- Finding
Arbitrary Python Code Injection Through Unsanitized Generated Source
- Content
View full analysis
str: method_upper = method.upper() method_lower = method.lower() auth_fixture = "" auth_call = "" if auth == "bearer": auth_fixture = "auth_headers, " auth_call = ", headers=auth_headers" elif auth == "none": auth_fixture = "" auth_call = "" # 生成请求体示例（仅 POST/PUT/PATCH） body_example = "" body_param = "" if method_upper in ("POST", "PUT", "PATCH"): body_example = ''' # TODO: 替换为真实的请求体参数 payload = { "key": "value", }''' body_param = ", json=payload" return f'''\ """ {name} — 接口自动化测试 生成日期: {date.today()} 接口: {method_upper} {path} 使用方法: pytest {module}.py -v pytest {module}.py -v --html=report.html """ import pytest import requests class Test{name.replace(" ", "").replace("-", "").replace("（", "").replace("）", "")}: ``` The endpoint path is also inserted directly into executable Python syntax: ```python url = f"{{base_url}}{path}"{body_example} ``` The generated content is written to a Python test file without validation or safe serialization: ```python module = to_snake_case(args.name) test_filename = f"test_{module}.py" os.makedirs(args.out, exist_ok=True) test_path = os.path.join(args.out, test_filename) with open(test_path, "w", encoding="utf-8") as f: f.write(generate_test_file(args.name, args.method, args.path, args.auth, module)) ``` ### Technical Analysis The `--name` and `--path` command-line arguments are interpolated directly into generated Python source code. The transformations applied to `name` remove only a small set of characters and do not guarantee a valid, safe Python identif ...[truncated 2039 chars]- Remediation
View remediation