T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imou_client.py:23- Finding
Credential-Bearing Requests Can Be Redirected to an Untrusted or Plaintext Endpoint
- Content
View full analysis
str: """Build sign: MD5 of 'time:{time},nonce:{nonce},appSecret:{app_secret}' (UTF-8), 32-char lowercase hex.""" raw = f"time:{time_sec},nonce:{nonce},appSecret:{app_secret}" return hashlib.md5(raw.encode("utf-8")).hexdigest() def _request(method: str, params: dict, app_id: str, app_secret: str, base_url: str = None) -> dict: """ Send one Open API request. :param method: API method name. :param params: Request params object. :param app_id: App ID. :param app_secret: App secret for sign. :param base_url: Optional base URL; uses env IMOU_BASE_URL or default if None. :return: Full response body as dict; check result.code for '0'. """ base = base_url or _get_base_url() url = f"{base.rstrip('/')}/openapi/{method}" time_sec = int(time.time()) nonce = uuid.uuid4().hex sign = _build_sign(time_sec, nonce, app_secret) body = { "system": { "ver": "1.0", "appId": app_id, "sign": sign, "time": time_sec, "nonce": nonce, }, "id": str(uuid.uuid4()), "params": params, } headers = { "Content-Type": "application/json", OPENCLAW_HEADER: OPENCLAW_HEADER_VALUE, } resp = requests.post(url, headers=headers, json=body, timeout=30) ``` The CLI passes the environment-controlled URL directly into this request path: ```python APP_ID = os.environ.get("IMOU_APP_ID", "") APP_SECRET = os.environ.get("IMOU_APP_SECRET", "") BASE_URL = os.environ.ge ...[truncated 3082 chars]- Remediation
View remediation