T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imou_client.py:25- Finding
Unrestricted API Base URL Allows Sensitive Authentication and Device Data Redirection
- Content
View full analysis
dict: """ Send one Open API request. :param method: API method name (e.g. 'accessToken', 'listDeviceDetailsByPage'). :param params: Request params object. :param app_id: App ID. :param app_secret: App secret for sign. :param base_url: Optional base URL; uses env IMOU_BASE_URL or default if None. :return: Full response body as dict; check result.code for '0'. """ base = base_url or _get_base_url() url = f"{base.rstrip('/')}/openapi/{method}" time_sec = int(time.time()) nonce = uuid.uuid4().hex sign = _build_sign(time_sec, nonce, app_secret) body = { "system": { "ver": "1.0", "appId": app_id, "sign": sign, "time": time_sec, "nonce": nonce, }, "id": str(uuid.uuid4()), "params": params, } headers = { "Content-Type": "application/json", OPENCLAW_HEADER: OPENCLAW_HEADER_VALUE, } resp = requests.post(url, headers=headers, json=body, timeout=30) resp.raise_for_status() return resp.json() ``` The CLI passes the environment-controlled value directly into the client: ```python APP_ID = os.environ.get("IMOU_APP_ID", "") APP_SECRET = os.environ.get("IMOU_APP_SECRET", "") BASE_URL = os.environ.get("IMOU_BASE_URL", "").strip() or "https://openapi.lechange.cn" def _ensure_token(): if not APP_ID or not APP_SECRET: print("[ERROR] Set IMOU_APP_ID and IMOU_APP_SECRET.", file=sys.stderr) ...[truncated 4094 chars]- Remediation
View remediation