T09 · Insecure Skill Coding Practices
Error
- Location
scripts/miner_detector.py:24- Finding
Configurable billing origin can disclose the API key and user identifier
- Content
View full analysis
Dict[str, Any]: headers = {"X-API-Key": api_key} data = None if payload is not None: headers["Content-Type"] = "application/json" data = json.dumps(payload).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=30) as resp: body = resp.read().decode("utf-8", errors="replace") except urllib.error.HTTPError as exc: body = exc.read().decode("utf-8", errors="replace") try: parsed = json.loads(body) except json.JSONDecodeError as json_exc: raise BillingError(f"HTTP {exc.code}: {body}") from json_exc raise BillingError(json.dumps(parsed, ensure_ascii=False)) from exc except urllib.error.URLError as exc: raise BillingError(f"Network error: {exc}") from exc try: return json.loads(body) except json.JSONDecodeError as exc: raise BillingError(f"Invalid JSON response: {body}") from exc def check_balance(user_id: str, api_key: str) -> Dict[str, Any]: query = urllib.parse.urlencode({"user_id": user_id}) url = f"{BILLING_API_URL}/api/v1/billing/balance?{query}" return _http_json("GET", url, api_key) def charge_user(user_id: str, api_key: str, amount: float = DEFAULT_CHARGE_AMOUNT) -> Dict[str, Any]: url = f"{BILLING_API_URL}/api/v1/billing/charge" return _http_json( "POST", url, api_key, { "user_id": user_id, "skill_id": SKILL_ID, ...[truncated 2762 chars]- Remediation
View remediation