T09 · Insecure Skill Coding Practices
Error
- Location
scripts/google_maps_reviews_scraper_actor.py:128- Finding
Apify API Token Exposed Through URL Query Parameters and CLI Arguments
- Content
View full analysis
str: token = explicit or os.getenv("APIFY_TOKEN", "") if not token: raise SkillError("Apify token missing. Pass --apify-token or set APIFY_TOKEN.") return token ``` ```python params: dict[str, str | int | float] = { "token": token, "timeout": timeout_sec, "clean": "true", } if budget_usd is not None: if budget_usd <= 0: raise SkillError("--budget-usd must be > 0.") params["maxTotalChargeUsd"] = budget_usd url = ( f"https://api.apify.com/v2/acts/{urllib.parse.quote(actor_id, safe='')}/run-sync-get-dataset-items" f"?{urllib.parse.urlencode(params)}" ) body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url=url, data=body, headers={"Content-Type": "application/json"}, method="POST", ) ``` ```python parser.add_argument("--apify-token", help="Apify API token (fallback: APIFY_TOKEN env)") ``` ### Technical Analysis The Apify token is inserted into the request URL as the `token` query parameter. Although the request uses HTTPS, query strings may still be recorded by client diagnostics, HTTP infrastructure, monitoring products, reverse proxies, exception telemetry, or endpoint-side access logs. HTTPS protects the URL while it is in transit but does not prevent disclosure through local or server-side logging. The optional `--apify-token` argument creates an additional exposure channel. Command-line arguments can be retained in shell history and may be visible to other local users through process-inspection interfaces while the command is running. The network request itself is necessary for the declared Apify-backed functionality. However, placing the credential in the U ...[truncated 1062 chars]- Remediation
View remediation