T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.py:10- Finding
Configurable API Endpoint Can Disclose Credentials and Uploaded Files
- Content
View full analysis
dict: """POST request to the agent-im OpenAPI""" url = f"{IM_BASE.rstrip('/')}{path}" data = json.dumps(body).encode("utf-8") req = urllib.request.Request( url, data=data, method="POST", headers=_headers(), ) try: with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode("utf-8")) ``` From `scripts/upload_file.py`: ```python # accessKey field body_parts.append(f"--{boundary}\r\n".encode()) body_parts.append(b'Content-Disposition: form-data; name="accessKey"\r\n\r\n') body_parts.append(f"{ACCESS_KEY}\r\n".encode()) url = f"{IM_BASE.rstrip('/')}/openapi/upload" req = urllib.request.Request( url, data=data, method="POST", headers={ "Authorization": f"Bearer {ACCESS_KEY}", "Content-Type": f"multipart/form-data; boundary={boundary}", }, ) try: with urllib.request.urlopen(req, timeout=120) as resp: result = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The destination for authenticated API traffic is taken directly from `OPENAPI_IM_BASE` or `IM_BASE_URL`. The implementation does not enforce HTTPS, validate the hostname, restrict ports, or require approval before using a nondefault server. Every session request sends `LIBTV_ACCESS_KEY` in the `Authoriz ...[truncated 1697 chars]- Remediation
View remediation