T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tapd_client_stdlib.py:42- Finding
Authentication Credentials Sent to an Unrestricted Configurable API Destination
- Content
View full analysis
str: base = os.environ.get("TAPD_API_BASE_URL", DEFAULT_TAPD_API_BASE_URL) return base.rstrip("/") def _get_headers() -> dict: token = os.environ.get("TAPD_ACCESS_TOKEN") if token: return { "Authorization": f"Bearer {token}", "Content-Type": "application/json", "Via": "mcp", } user = os.environ.get("TAPD_API_USER") password = os.environ.get("TAPD_API_PASSWORD") if not user or not password: raise ValueError( "请设置 TAPD_ACCESS_TOKEN 或 TAPD_API_USER + TAPD_API_PASSWORD" ) auth = b64encode(f"{user}:{password}".encode()).decode() return { "Authorization": f"Basic {auth}", "Content-Type": "application/json", "Via": "mcp", } def request( method: str, endpoint: str, params: Optional[dict] = None, data: Optional[dict] = None, timeout: int = 30, ) -> dict: """ 发送 TAPD API 请求。URL 自动追加 ?s=mcp 或 &s=mcp。 :param method: GET 或 POST :param endpoint: 路径，如 "stories", "workspaces/get_workspace_info" :param params: GET 查询参数或 POST 时也可拼在 URL（部分接口习惯用 query） :param data: POST 请求体（JSON） :param timeout: 超时秒数 :return: 响应 JSON（dict） """ base = _get_base_url() url = f"{base}/{endpoint.lstrip('/')}" sep = "&" if "?" in url else "?" url = f"{url}{sep}s=mcp" if params: encoded = urllib.parse.urlencode(params, doseq=True) url = f"{url}&{encoded}" if "?" in url else f"{url}?{encoded}" headers = _get_headers() req_body = None if method.upper() == "POST" and data is not None: req_body = json.dumps(data).encode("utf-8") req = urllib.request.Request( url, data=req_body, ...[truncated 3312 chars]- Remediation
View remediation