T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mp_client.py:556- Finding
Authenticated WeChat credentials can be relayed to an arbitrary gateway
- Content
View full analysis
dict[str, str]: headers = { "User-Agent": session.headers.get("User-Agent", DEFAULT_USER_AGENT), "Referer": session.headers.get("Referer", referer), "Origin": session.headers.get("Origin", "https://mp.weixin.qq.com"), "Accept-Encoding": session.headers.get("Accept-Encoding", "identity"), } cookie_header = requests.utils.dict_from_cookiejar(session.cookies) if cookie_header: headers["Cookie"] = "; ".join(f"{k}={v}" for k, v in cookie_header.items()) return headers def _build_gateway_url( self, target_url: str, *, proxy_base: str | None = None, headers: dict[str, str] | None = None, include_headers: bool = False, normalize_article: bool = False, preset: str = "", ) -> str: gateway_base = proxy_base or self._gateway_base_url() normalized_target = normalize_mp_article_short_url(target_url) if normalize_article else target_url separator = '&' if '?' in gateway_base else '?' gateway_url = f"{gateway_base}{separator}url={quote(normalized_target, safe=':/')}" if preset: gateway_url += f"&preset={quote(preset, safe='')}" if include_headers and headers: header_json = json.dumps(headers or {}, ensure_ascii=False) gateway_url += f"&headers={quote(header_json, safe='')}" return gateway_url ``` The authenticated synchronization request is constructed as follows: ```python def _request_sync_article_page(self, session: Session, params: dict[str, Any]) -> dict[str, Any]: endpoint = "https://mp.weixin.qq.com/cgi-bin/appmsgpublish" ...[truncated 3128 chars]- Remediation
View remediation