T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat.py:1694- Finding
Private WeChat Messages and API Credentials Can Be Transmitted to Arbitrary Plaintext Endpoints
- Content
View full analysis
None: ``` ```python latest_messages = self._get_latest_messages(message_rects) if latest_messages: # Call the AI interface to obtain replies ai_replies = self._call_ai_api(latest_messages, api_url, api_key) ``` ```python def _call_ai_api(self, customer_messages: List[str], api_url: str, api_key: str) -> List[Dict[str, Any]]: try: headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}" } # Combine customer messages into one string combined_message = "\n".join(customer_messages) data = { "user_id": "7", "message": combined_message, "username": "" } self.logger.info(f"调用AI接口: {api_url}") self.logger.info( f"请求消息: {len(customer_messages)}条，合并为: " f"{combined_message[:50]}..." ) response = requests.post( api_url, json=data, headers=headers, timeout=30 ) ``` ### Technical Analysis The automatic-reply feature extracts incoming WeChat messages from the desktop interface, joins them into a single string, and submits them verbatim to `api_url`. The request also includes the configured API credential as a bearer token. The destination is entirely controlled through the `--api_url` argument. The implementation does not: - Require HTTPS for non-loopback destinations. - R ...[truncated 2256 chars]- Remediation
View remediation