T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_address.py:57- Finding
Authentication credentials can be transmitted to an unrestricted API destination
- Content
View full analysis
tuple[Optional[dict], Optional[str]]: admin_auth = args.admin_auth or os.getenv(ENV_ADMIN_AUTH) if not admin_auth: return None, f"missing admin credential: provide --admin-auth or {ENV_ADMIN_AUTH}" headers = { "Content-Type": "application/json", "x-admin-auth": admin_auth, } bearer_token = args.bearer_token or os.getenv(ENV_BEARER_TOKEN) if bearer_token: token = bearer_token.strip() headers["Authorization"] = token if token.lower().startswith("bearer ") else f"Bearer {token}" fingerprint = args.fingerprint or os.getenv(ENV_FINGERPRINT) if fingerprint: headers["x-fingerprint"] = fingerprint lang = args.lang or os.getenv(ENV_LANG) if lang: headers["x-lang"] = lang user_token = args.user_token or os.getenv(ENV_USER_TOKEN) if user_token: headers["x-user-token"] = user_token return headers, None ``` ```python def call_create_address( api_url: str, headers: dict, timeout: float, name: str, domain: str, enable_prefix: bool, ) -> dict: address = f"{name}@{domain}" body = json.dumps( { "enablePrefix": enable_prefix, "name": name, "domain": domain, } ).encode("utf-8") req = request.Request(api_url, data=body, headers=headers, method="POST") try: with request.urlopen(req, timeout=timeout) as response: ``` ### Technical Analysis The API destina ...[truncated 2480 chars]- Remediation
View remediation