T09 · Insecure Skill Coding Practices
Error
- Location
scripts/doorlock_control.py:29- Finding
Unrestricted API Endpoint Can Redirect Sensitive Authentication and Door-Lock Data
- Content
View full analysis
Dict[str, str]: """Generate request headers containing a signature and timestamp.""" time_millis = get_time_millis() signature = generate_signature(uuid, app_key, app_secret, time_millis, move_card) return { "Content-Type": "application/json; charset=UTF-8", "uuid": uuid, "appKey": app_key, "timeMillis": time_millis, "signature": signature, "X-Request-Id": os.urandom(16).hex() } ``` The original source contains a Chinese docstring; it is translated above without changing executable behavior. ```python body = {"UserName": username} if password: body["PassWord"] = password if keepalive_time > 0: body["KeepaliveTime"] = keepalive_time response = requests.post(url, headers=headers, json=body, timeout=30) ``` ```python body = {"sn": device_sn, "props": {}} if password: body["props"]["doorLock"] = { "remoteUnlock": { "password": password } } else: body["props"]["doorLock"] = { "remoteOneKeyUnlock": 1, "userType": 5, "memberID": 1 } response = requests.post(url, headers=headers, json=body, timeout=30) ``` ### Technical Analysis The API hostname is taken directly from the `JF_ENDPOINT` environment variable and interpolated into the destination URL without validating it against the four documented vendor endpoints. Every request transmits authentication-related headers containing the account UUID, application key, timestamp, and a signature derived from the application secr ...[truncated 2272 chars]- Remediation
View remediation