T09 · Insecure Skill Coding Practices
Error
- Location
scripts/yufluent_api.py:20- Finding
Bearer Token and Sensitive Business Data Can Be Transmitted over an Untrusted Plaintext Endpoint
- Content
View full analysis
str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` ```python def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } ``` ```python def _post_json( url: str, *, api_key: str, body: dict[str, Any] | None = None, timeout: float, ) -> requests.Response: kwargs: dict[str, Any] = { "headers": _json_headers(api_key) if body is not None else _auth_headers(api_key), "timeout": timeout, } if body is not None: kwargs["json"] = body return requests.post(url, **kwargs) ``` ```python root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) except requests.RequestException as exc: raise YufluentApiError(f"Request failed: {exc}") from exc ``` The transmitted payload is assembled in `scripts/run.py`: ```python payload: dict = { "message": args.message.strip(), "product": args.product.strip(), "mode": args.mode, "platform": args.platform, "lang": args.lang, } if args.target_market: payload["target_market"] = args.target_market.strip() if args.category: payload["category"] = args.category.strip() if args.material: payload["material"] = args.material.strip() if args.declared_value: payload["declared_value"] = args.declared_value.strip() if args.hs_code: payload["hs_code"] = args.hs_code.strip() if args.origin ...[truncated 2687 chars]- Remediation
View remediation