T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chainup_api.py:479- Finding
Arbitrary API Endpoint Can Receive Automatically Loaded Exchange Credentials
- Content
View full analysis
Dict[str, Any]: method_u = method.upper() query = query or {} query = {k: v for k, v in query.items() if v is not None} body = {k: v for k, v in (body or {}).items() if v is not None} query_str = urlencode(query, doseq=True) request_path = path + (f"?{query_str}" if query_str else "") url = urljoin(self.cfg.base_url.rstrip("/") + "/", request_path.lstrip("/")) payload_bytes = None body_str_for_sign = None if method_u != "GET": body_str_for_sign = self._json_dumps_compact(body) if body else "{}" payload_bytes = body_str_for_sign.encode("utf-8") headers = { "Content-Type": "application/json", "admin-language": "en_US", "User-Agent": USER_AGENT, } if signed: ts_ms = str(int(time.time() * 1000)) headers["X-CH-APIKEY"] = self.cfg.api_key headers["X-CH-TS"] = ts_ms headers["X-CH-SIGN"] = self._sign( ts_ms, method_u, request_path, body_str_for_sign ) req = Request(url=url, data=payload_bytes, method=method_u, headers=headers) try: with urlopen(req, timeout=self.cfg.timeout) as resp: ``` ```python def _build_config(args: argparse.Namespace) -> ChainUpConfig: tools_cfg = _load_tools_config() base_url = ( args.base_url or tools_cfg.get("BASE_URL", "") or os.getenv("CHAINUP_BASE_URL", "") ) api_key = ( args.api_key or tools_cfg.get("API_KEY", "") or os.getenv("CHAINUP_API_KEY", "") ) secret_key = ( ...[truncated 3411 chars]- Remediation
View remediation