T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hik_open_device_channel_management.py:109- Finding
Unrestricted Base URL Can Exfiltrate Client Credentials and Bearer Tokens
- Content
View full analysis
str: if explicit_base_url: return normalize_base_url(explicit_base_url) env_base_url = os.getenv(BASE_URL_ENV_VAR) if env_base_url: return normalize_base_url(env_base_url) return DEFAULT_BASE_URL ``` ```python def fetch_access_token( base_url: str, client_id: str, client_secret: str, timeout: float, ) -> dict[str, Any]: status, payload = http_json_request( method="POST", url=base_url.rstrip("/") + TOKEN_PATH, headers=None, timeout=timeout, form_body={ "client_id": client_id, "client_secret": client_secret, "grant_type": "client_credentials", "scope": "app", }, ) if status != 200 or "access_token" not in payload: error_code, error_message = summarize_error_payload(payload) raise ApiError( "failed to fetch access token: " f"http={status}, code={error_code}, message={error_message}" ) expires_in = int(payload.get("expires_in", 0)) return { "access_token": payload["access_token"], "expires_in": expires_in, "expires_at": time.time() + max(expires_in, 0), "token_type": payload.get("token_type", "bearer"), } ``` ```python def resolve_access_token( base_url: str, timeout: float, cache_file: Path, explicit_token: str | None, ) -> tuple[str, bool]: if explicit_token: return explicit_token, False env_token = os.getenv("HIK_OPEN_ACCESS_TOKEN") if env_token: return env_tok ...[truncated 5290 chars]- Remediation
View remediation