T09 · Insecure Skill Coding Practices
Error
- Location
scripts/imou_client.py:33- Finding
Unrestricted API Base URL Can Expose Authentication Material and Administrative Device Tokens
- Content
View full analysis
str: """Build sign: MD5 of 'time:{time},nonce:{nonce},appSecret:{app_secret}' (UTF-8), 32-char lowercase hex.""" raw = f"time:{time_sec},nonce:{nonce},appSecret:{app_secret}" return hashlib.md5(raw.encode("utf-8")).hexdigest() def _request(method: str, params: dict, app_id: str, app_secret: str, base_url: str = None) -> dict: """ Send one Open API request. :param method: API method name (e.g. 'accessToken', 'setDeviceSnapEnhanced', 'controlMovePTZ'). :param params: Request params object. :param app_id: App ID. :param app_secret: App secret for sign. :param base_url: Optional base URL; uses env IMOU_BASE_URL or default if None. :return: Full response body as dict; check result.code for '0'. """ base = base_url or _get_base_url() url = f"{base.rstrip('/')}/openapi/{method}" time_sec = int(time.time()) nonce = uuid.uuid4().hex sign = _build_sign(time_sec, nonce, app_secret) body = { "system": { "ver": "1.0", "appId": app_id, "sign": sign, "time": time_sec, "nonce": nonce, }, "id": str(uuid.uuid4()), "params": params, } headers = { "Content-Type": "application/json", OPENCLAW_HEADER: OPENCLAW_HEADER_VALUE, } resp = requests.post(url, headers=headers, json=body, timeout=30) resp.raise_for_status() return resp.json() ``` The affected requests subsequently include administrative tokens and device identifiers: ```python out = _request( "setDeviceSnapEnhanced", { "token": token, ...[truncated 2833 chars]- Remediation
View remediation