T09 · Insecure Skill Coding Practices
Error
- Location
scripts/api_client.py:104- Finding
Database Credentials Can Be Transmitted to an Untrusted KDTS Endpoint over Plaintext HTTP
- Content
View full analysis
str: """Build full API URL from endpoint path.""" return f"{self.base_url}{self.api_prefix}{endpoint}" def _request(self, method: str, endpoint: str, data: Optional[Dict] = None, params: Optional[Dict] = None) -> Dict[str, Any]: url = self._build_url(endpoint) try: if method == 'GET': response = self.session.get( url, params=params, timeout=(self.connect_timeout, self.timeout) ) elif method == 'POST': response = self.session.post( url, json=data, timeout=(self.connect_timeout, self.timeout) ) ``` The destination is allowed to use HTTP and may be supplied through parameters, environment variables, or configuration files: ```python # scripts/config.py if explicit_url: logger.info(f"Using explicit base_url: {explicit_url}") return self._normalize_url(explicit_url) env_base_url = os.environ.get(ENV_BASE_URL) if env_base_url: logger.info(f"Using base_url from environment: {env_base_url}") return self._normalize_url(env_base_url) if env_host and env_port: url = f"http://{env_host}:{env_port}" logger.info(f"Using host+port from environment: {url}") return self._normalize_url(url) default_url = f"http://{DEFAULT_HOST}:{DEFAULT_PORT}" logger.info(f"Using default base_url: {default_url}") return default_url ``` ```python @staticmethod def _normalize_url(url: str) -> str: """Normalize ...[truncated 3797 chars]- Remediation
View remediation
str: parsed = urlparse(url) if parsed.scheme not in {"https", "http"}: raise ValueError("Only HTTPS endpoints are supported") host = parsed.hostname if not host: raise ValueError("KDTS endpoint must include a hostname") addresses = { ipaddress.ip_address(item[4][0]) for item in socket.getaddrinfo(host, parsed.port or 443) } loopback_only = addresses and all(address.is_loopback for address in addresses) if parsed.scheme != "https" and not loopback_only: raise ValueError("Plaintext HTTP is allowed only for loopback development endpoints") return url.rstrip("/") ``` 2. Change all remote examples and templates to `https://`. 3. Do not silently prepend `http://`; reject URLs without an explicit scheme. 4. Require explicit user confirmation before first sending credentials to a newly configured KDTS hostname. 5. Provide an administrator-configurable hostname or certificate allowlist. 6. Retain TLS certificate verification and optionally support certificate pinning or a private CA bundle. 7. Prevent redirects from forwarding credential-bearing POST bodies to a different host. Configure requests not to follow redirects for sensitive operations or validate every redirect destination. 8. Add authentication between the client and KDTS, such as mutual TLS or a scoped API token. 9. Use database accounts restricted to only the schemas and operations required for migration. 10. Avoid placing passwords in chat transcripts, command-line arguments, examples, logs, or persistent configuration files. Prefer a secret manager or protected environment-based secret reference. 11. Add automated tests proving that remote HTTP endpoints and unsupported URL schemes are rejected. ]]>