T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/common.py:83- Finding
Bearer credentials and uploaded documents may be transmitted over insecure transport or cross-origin redirects
- Content
View full analysis
str: base_url = (cli_base_url or "").strip() or _require_env_var(RAGFLOW_API_URL_ENV) parsed = urllib.parse.urlsplit(base_url) if not parsed.scheme or not parsed.netloc: raise ConfigError( f"Invalid {RAGFLOW_API_URL_ENV}. Use an absolute URL such as http://127.0.0.1:9380." ) return base_url.rstrip("/") ``` ```python def request_json( url: str, api_key: str, *, method: str = "GET", body: bytes | None = None, content_type: str | None = None, accept: str = "application/json", ) -> dict[str, Any]: headers = {"Authorization": f"Bearer {api_key}"} if accept: headers["Accept"] = accept if content_type: headers["Content-Type"] = content_type request_obj = urllib.request.Request(url, headers=headers, data=body, method=method) try: with urllib.request.urlopen(request_obj, timeout=HTTP_TIMEOUT) as response: return decode_json_response(response.read()) ``` From `scripts/upload.py`: ```python def upload_documents(dataset_id: str, file_paths: list[str], *, base_url: str, api_key: str) -> dict[str, Any]: missing = [path for path in file_paths if not Path(path).exists()] if missing: raise ConfigError("File(s) not found: " + ", ".join(missing)) boundary, body = _build_multipart(file_paths) url = f"{base_url}/api/v1/datasets/{dataset_id}/documents" request_obj = urllib.request.Request(url, data=body, method="POST") request_obj.add_header("Authorization", f"Bearer {api_key}") request_obj.add_header("Content-Type", f"multipart/form-data; boundary={boundary ...[truncated 3301 chars]- Remediation
View remediation