T09 · Insecure Skill Coding Practices
Error
- Location
scripts/maas_common.py:38- Finding
Caller-Controlled MaaS Endpoint Can Exfiltrate API Keys and Request Payloads
- Content
View full analysis
str: """Return a normalized MaaS endpoint URL.""" if path.startswith("http://") or path.startswith("https://"): return path return f"{base_url.rstrip('/')}/{path.lstrip('/')}" ``` ```python def build_headers(api_key: str) -> dict[str, str]: """Build MaaS JSON API headers.""" return { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } def request_json( method: str, path: str, *, api_key: str, body: dict[str, Any] | None = None, timeout: int = 120, base_url: str = DEFAULT_MAAS_BASE_URL, ) -> dict[str, Any]: """Call a MaaS JSON API endpoint and return a structured response.""" url = endpoint_url(path, base_url) payload = None if body is None else json.dumps(body, ensure_ascii=False).encode("utf-8") request = urllib.request.Request(url, data=payload, headers=build_headers(api_key), method=method.upper()) ``` The chat caller obtains the real API key and passes the caller-controlled base URL to this transport: ```python api_key = maas_common.get_api_key() response = maas_common.request_json( "POST", endpoint_path(args), api_key=api_key, body=payload, timeout=args.timeout, base_url=args.base_url, ) ``` ```python parser.add_argument("--base-url", default=maas_common.DEFAULT_MAAS_BASE_URL) ``` Equivalent `--base-url` execution paths are also present in `scripts/maas_models.py`, `scripts/maas_image_generation.py`, and `scripts/maas_video_generation.py`. ### Technical Analysis The MaaS transport accepts an arbitrary caller-provided base URL and attaches the Huawei MaaS API key as an HTTP bearer credential with ...[truncated 1967 chars]- Remediation
View remediation