T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/website_email_scraper_actor.py:171- Finding
Apify API Token Exposed Through Command-Line Arguments and URL Query Parameters
- Content
View full analysis
str: token = explicit or os.getenv("APIFY_TOKEN", "") if not token: raise SkillError("Apify token missing. Pass --apify-token or set APIFY_TOKEN.") return token ``` ```python def run_actor(token: str, actor_id: str, payload: dict[str, Any], timeout_sec: int, budget_usd: float | None) -> dict[str, Any]: params: dict[str, str | int | float] = { "token": token, "timeout": timeout_sec, "clean": "true", } if budget_usd is not None: if budget_usd <= 0: raise SkillError("--budget-usd must be > 0.") params["maxTotalChargeUsd"] = budget_usd actor_path = urllib.parse.quote(actor_id, safe="") url = f"https://api.apify.com/v2/acts/{actor_path}/run-sync-get-dataset-items?{urllib.parse.urlencode(params)}" ``` ```python parser.add_argument("--apify-token") ``` ### Technical Analysis The runner permits the Apify credential to be supplied through the `--apify-token` command-line option. Command-line arguments can be retained in shell history and may be visible in process inspection facilities to other accounts with sufficient local permissions. Regardless of whether the token originates from the environment or the command line, `run_actor` places it in the URL query string as `token=`. HTTPS protects the URL from passive network observers while it is in transit, but query strings are frequently captured by application diagnostics, HTTP debugging tools, endpoint monitoring, proxy infrastructure, or telemetry. Credential-bearing URLs may also be copied or disclosed during trouble ...[truncated 1308 chars]- Remediation
View remediation