T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common.py:321- Finding
Unrestricted RAG endpoint can receive API credentials, user queries, and corpus content
- Content
View full analysis
dict[str, Any]: body = json.dumps(payload).encode("utf-8") headers = {"Content-Type": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" request = urllib.request.Request(url, data=body, headers=headers, method="POST") try: with urllib.request.urlopen(request, timeout=120) as response: return json.loads(response.read().decode("utf-8")) ``` `scripts/common.py:338-352`: ```python def resolve_service_config(config: dict[str, Any], section: str) -> dict[str, Any]: rag_cfg = config.get("rag", {}) api_cfg = rag_cfg.get("api", {}) service_cfg = dict(rag_cfg.get(section, {})) if not service_cfg.get("base_url") and api_cfg.get("base_url"): service_cfg["base_url"] = api_cfg["base_url"] if not service_cfg.get("provider") and api_cfg.get("provider"): service_cfg["provider"] = api_cfg["provider"] api_key_env = service_cfg.get("api_key_env") or api_cfg.get("api_key_env") if api_key_env: service_cfg["api_key_env"] = str(api_key_env) service_cfg["api_key"] = os.environ.get(str(api_key_env), "") elif service_cfg.get("api_key"): pass elif api_cfg.get("api_key"): service_cfg["api_key"] = os.environ.get(str(api_cfg["api_key"]), "") ``` `scripts/common.py:357-396`: ```python def embed_texts(texts: list[str], config: dict[str, Any]) -> list[list[float]]: embedding_cfg = resolve_service_config(config, "embedding") base_url = str(embedding_cfg.get("base_url", "")).rstrip("/") model = embedding_cfg.get ...[truncated 5653 chars]- Remediation
View remediation