T09 · Insecure Skill Coding Practices
Error
- Location
scripts/hik_open_device_group_management.py:97- Finding
Credentials and bearer tokens can be redirected to arbitrary or plaintext endpoints
- Content
View full analysis
str: normalized = base_url.strip() if not normalized: raise ApiError("base URL must not be empty") return normalized.rstrip("/") def resolve_base_url(explicit_base_url: str | None) -> str: if explicit_base_url: return normalize_base_url(explicit_base_url) env_base_url = os.getenv(BASE_URL_ENV_VAR) if env_base_url: return normalize_base_url(env_base_url) return DEFAULT_BASE_URL ``` ```python def fetch_access_token( base_url: str, client_id: str, client_secret: str, timeout: float, ) -> dict[str, Any]: status, payload = http_json_request( method="POST", url=base_url.rstrip("/") + TOKEN_PATH, headers=None, timeout=timeout, form_body={ "client_id": client_id, "client_secret": client_secret, "grant_type": "client_credentials", "scope": "app", }, ) if status != 200 or "access_token" not in payload: error_code, error_message = summarize_error_payload(payload) raise ApiError( "failed to fetch access token: " f"http={status}, code={error_code}, message={error_message}" ) ``` ```python token_payload = fetch_access_token(base_url, client_id, client_secret, timeout) ``` ### Technical Analysis The Skill legitimately needs to transmit a client ID and client secret to the Hik-Cloud token endpoint. However, the destination is derived from the `--base-url` argument or `HIK_OPEN_BASE_URL` environment variable without validating the URL scheme, hostname, port, user information, or intended trust boundary. Consequently, the script permits ...[truncated 2364 chars]- Remediation
View remediation