T09 · Insecure Skill Coding Practices
- Location
scripts/request_client.py:18- Finding
Bearer API credentials can be transmitted over unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/request_client.py:18-35, 39-42, 54-63
Vulnerability Type: Missing HTTPS enforcement for authenticated API requests
Risk Level: HighVulnerable Code
python def __init__( self, base_url: str, api_key: str, timeout: int = 30, ) -> None: if not base_url: raise ValueError("base_url 不能为空") if not api_key: raise ValueError("api_key 不能为空") self.base_url = base_url self.api_key = api_key self.timeout = timeout self.session = requests.Session() self.session.headers.update({ "Authorization": f"Bearer {self.api_key}", }) def _build_url(self, path: str) -> str: base_url = self.base_url.rstrip("/") path = path.lstrip("/") return f"{base_url}/{path}"The resulting URL is used without scheme validation:
python url = self._build_url(path) response = self.session.request( method, url, params=params, data=data, json=json, timeout=self.timeout, **kwargs, )Technical Analysis
The client accepts any non-empty
base_urland unconditionally attaches a bearer API key to its session. It does not parse the URL or require the HTTPS scheme. Consequently, anhttp://base URL is accepted and theAuthorizationheader is transmitted without transport encryption.Restricting requests to a user-configured destination does not provide confidentiality or server authenticity. Plain HTTP allows an attacker with a suitable network position to observe or modify traffic. The problem affects every authenticated query and mutation exposed by the client.
Attack Path
- A merchant or platform configuration supplies an
RR_CLAW_BASE_URLbeginning withhttp://, whether through error, insecure deployment guidance, or configuration tampering. RequestClient.__init__accepts the value because it only checks whether it is empty.- The client stores the API key in the session-wide `Authorizat ...[truncated 1032 chars]
- A merchant or platform configuration supplies an
- Remediation
View remediation
Remediation Suggestions
- Parse
base_urlwithurllib.parse.urlsplitduring initialization. - Reject every scheme except
https. - Reject URLs containing embedded usernames or passwords.
- Require a valid hostname and reject malformed or ambiguous URLs.
- If local HTTP development is necessary, require an explicit development-only option and restrict it to loopback addresses such as
127.0.0.1and::1. - Keep TLS certificate verification enabled and do not permit callers to override it through unrestricted request keyword arguments.
- Add tests confirming that HTTP, scheme-relative, credential-bearing, and malformed URLs are rejected.
- Document HTTPS as mandatory for
RR_CLAW_BASE_URL.
Example hardening:
python from urllib.parse import urlsplit parsed = urlsplit(base_url) if parsed.scheme.lower() != "https": raise ValueError("base_url must use HTTPS") if not parsed.hostname: raise ValueError("base_url must contain a valid hostname") if parsed.username is not None or parsed.password is not None: raise ValueError("base_url must not contain embedded credentials")- Parse