T09 · Insecure Skill Coding Practices
Error
- Location
lib/amadeus_client.py:17- Finding
Unrestricted API endpoint configuration can exfiltrate credentials
- Content
View full analysis
bool: """Get OAuth2 token from Amadeus API""" url = self.auth_url data = { "grant_type": "client_credentials", "client_id": self.api_key, "client_secret": self.api_secret } try: response = requests.post(url, data=data, timeout=30) ``` The equivalent AviationStack behavior is: ```python def __init__(self, api_key: str, base_url: str = None): self.api_key = api_key # Default to HTTPS for security (API key sent in query params) self.base_url = base_url or "https://api.aviationstack.com/v1" self.request_count = 0 self.monthly_limit = 100 # Free tier limit ``` ```python url = f"{self.base_url}/flights" params = {"access_key": self.api_key} # Add optional parameters if flight_iata: params["flight_iata"] = flight_iata.upper() elif flight_icao: params["flight_icao"] = flight_icao.upper() if flight_number: params["flight_number"] = flight_number if date: params["flight_date"] = date if dep_iata: params["dep_iata"] = dep_iata.upper() if arr_iata: params["arr_i ...[truncated 2867 chars]- Remediation
View remediation