T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_shop_analytics_common.py:15- Finding
Configurable Gateway Allows Sensitive Credentials to Be Sent to an Untrusted Destination
- Content
View full analysis
str: key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print("API Key 未配置", file=sys.stderr) sys.exit(1) return key def call_api(endpoint: str, params: dict) -> dict: api_key = get_api_key() data = json.dumps(params).encode("utf-8") req = Request( endpoint, data=data, headers={ "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/1.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), }, method="POST", ) try: with urlopen(req, timeout=150) as response: return json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis The network request is necessary for the Skill's declared functionality, but its destination is not restricted to the documented LinkFox gateway. The `LINKFOX_TOOL_GATEWAY` and `TIKTOK_SHOP_API_BASE_URL` environment variables can replace the entire gateway origin with an arbitrary URL. The code does not enforce HTTPS, validate the destination hostname, restrict ports, reject URL user information, or otherwise verify that the destination belongs to LinkFox. Every request to the configured endpoint includes: - The LinkFox agent API key in the `Authorization` header. - The merchant's `openId` in ...[truncated 1701 chars]- Remediation
View remediation