T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/qweather_cli.py:28- Finding
API Credential Disclosure Through an Unvalidated Configurable Endpoint
- Content
View full analysis
Dict[str, Any]: url = f"{self.base_url}{endpoint}" query_params = "&".join( [f"{k}={urllib.parse.quote(str(v), safe='')}" for k, v in params.items()] ) full_url = f"{url}?{query_params}" # 构建请求头 - 使用 X-QW-Api-Key 方式 headers = { "X-QW-Api-Key": self.api_key, "Accept": "application/json", "Accept-Encoding": "gzip, deflate", } try: request = urllib.request.Request(full_url, headers=headers) with urllib.request.urlopen(request, timeout=10) as response: ``` ### Technical Analysis The client obtains `QWEATHER_BASE_URL` from an environment variable and uses it directly as the destination for authenticated network requests. It does not parse or validate the URL, require HTTPS, restrict the hostname to an authorized QWeather API host, reject embedded credentials or unusual ports, or constrain redirects. Every request includes the sensitive `QWEATHER_API_KEY` value in the `X-QW-Api-Key` header. Consequently, anyone who can influence the environment or configuration can redirect authenticated requests to an attacker-controlled server. A plaintext HTTP URL would additionally expose the API key and queried location to network observers and permit response modification. Network access and transmission of the API key to the legitimate QWeather service are necessary for the declared weather-query functionality. Allowing the credential to be sent to any confi ...[truncated 1501 chars]- Remediation
View remediation