T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ecommerce_product_kit.py:41- Finding
Unvalidated Configurable Network Destinations Can Receive API Credentials and Local Images
- Content
View full analysis
Dict[str, str]: ak = _require_ak() return { "Accept": "application/json, text/plain, */*", "Content-Type": "application/json", "Origin": "https://www.designkit.cn", "Referer": "https://www.designkit.cn/product-kit/?from=home", "X-Openclaw-AK": ak, "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", } ``` ```python def _http_request( method: str, url: str, body: Optional[bytes] = None, json_mode: bool = True, extra_headers: Optional[Dict[str, str]] = None, ) -> Tuple[int, Any]: headers = _headers_json() if json_mode and body else _headers_get() if extra_headers: headers.update(extra_headers) if body and "Content-Type" not in headers: headers["Content-Type"] = "application/json" _request_log_as_curl(method, url, headers, body) req = urllib.request.Request(url, data=body, headers=headers, method=method) try: with _urlopen(req, timeout=120) as resp: raw = resp.read().decode("utf-8", errors="replace") ``` The upload destination is also accepted directly from the remote upload policy: ```python provider = arr[0]["order"][0] p = arr[0][provider] token, key, up_url, up_data = p["token"], p["key"], p["url"], p["data"] b ...[truncated 4837 chars]- Remediation
View remediation