T09 · Insecure Skill Coding Practices
Error
- Location
scripts/device_list.py:25- Finding
Unvalidated API endpoint allows sensitive requests to be redirected to an arbitrary host
- Content
View full analysis
Dict[str, str]: """生成请求头（包含签名和时间戳）""" time_millis = get_time_millis() signature = generate_signature(uuid, app_key, app_secret, time_millis, move_card) return { "Content-Type": "application/json; charset=UTF-8", "uuid": uuid, "appKey": app_key, "timeMillis": time_millis, "signature": signature, "X-Request-Id": os.urandom(16).hex() } def query_device_list(uuid: str, app_key: str, app_secret: str, move_card: int, page: int = 1, limit: int = 100) -> Dict[str, Any]: """ 分页查询设备列表 API: POST /gwp/v3/rtc/device/list """ url = f"{JF_BASE_URL}/rtc/device/list" headers = get_headers(uuid, app_key, app_secret, move_card) body = { "page": page, "limit": limit } response = requests.post(url, headers=headers, json=body, timeout=30) result = response.json() if result.get("code") != 2000: raise RuntimeError(f"查询设备列表失败：{result.get('msg', '未知错误')}") return result.get("data", {}) def query_by_sns(uuid: str, app_key: str, app_secret: str, move_card: int, sns: List[str]) -> Dict[str, Any]: """ 按设备序列号查询 API: POST /gwp/v3/rtc/device/list """ url = f"{JF_BASE_URL}/rtc/device/list" headers = get_headers(uuid, app_key, app_secret, move_card) body = { "sns": sns } response = requests.post(url, headers=headers, json=body, timeout=30) ``` ### Technical Analysis The destination hostname i ...[truncated 2620 chars]- Remediation
View remediation