T09 · Insecure Skill Coding Practices
Error
- Location
scripts/common.py:113- Finding
Bearer Credential and Document Disclosure Through Unrestricted API Destinations
- Content
View full analysis
str: base_url = ( cli_base_url or os.getenv("RAGFLOW_API_URL") or os.getenv("RAGFLOW_BASE_URL") or os.getenv("HOST_ADDRESS") or DEFAULT_BASE_URL ).strip() parsed = urllib.parse.urlsplit(base_url) if not parsed.scheme or not parsed.netloc: raise ConfigError("Invalid base URL. Use an absolute URL such as http://127.0.0.1:9380.") return base_url.rstrip("/") ``` `scripts/common.py:193-212`: ```python def request_json( url: str, api_key: str, *, method: str = "GET", body: bytes | None = None, content_type: str | None = None, accept: str = "application/json", ) -> dict[str, Any]: headers = {"Authorization": f"Bearer {api_key}"} if accept: headers["Accept"] = accept if content_type: headers["Content-Type"] = content_type request_obj = urllib.request.Request(url, headers=headers, data=body, method=method) try: with urllib.request.urlopen(request_obj, timeout=HTTP_TIMEOUT) as response: return decode_json_response(response.read()) ``` `scripts/upload.py:126-138`: ```python def upload_documents(dataset_id: str, file_paths: list[str], *, base_url: str, api_key: str) -> dict[str, Any]: missing = [path for path in file_paths if not Path(path).exists()] if missing: raise ConfigError("File(s) not found: " + ", ".join(missing)) boundary, body = _build_multipart(file_paths) url = f"{base_url}/api/v1/datasets/{dataset_id}/documents" request_obj = urllib.request.Request(url, data=body, method="POST") request_obj.add_heade ...[truncated 3595 chars]- Remediation
View remediation