T09 · Insecure Skill Coding Practices
Error
- Location
toolkit/src/config.ts:75- Finding
Configurable API Base URL Can Expose Credentials and User Content to Arbitrary Hosts
- Content
View full analysis
; } { const raw = loadLayeredConfig(); const youmind = isPlainObject(raw.youmind) ? raw.youmind : {}; const imageYouMind = getImageYouMindConfig(raw); const apiKey = (typeof youmind.api_key === 'string' && youmind.api_key) || (typeof imageYouMind.api_key === 'string' && imageYouMind.api_key) || ''; const configuredBaseUrl = typeof youmind.base_url === 'string' ? normalizeBaseUrl(youmind.base_url) : ''; return { raw, apiKey, baseUrl: configuredBaseUrl || DEFAULT_YOUMIND_OPENAPI_BASE_URL, }; } ``` The resulting URL is used for credential-bearing requests: ```ts const response = await fetch(`${cfg.baseUrl}${endpoint}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, 'x-use-camel-case': 'true', }, body: JSON.stringify(body), signal: AbortSignal.timeout(30_000), }); ``` The general YouMind client uses the same pattern: ```ts const resp = await fetch(`${cfg.baseUrl}${endpoint}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-api-key': cfg.apiKey, }, body: JSON.stringify(body), signal: AbortSignal.timeout( endpoint.includes('Chat') || endpoint.includes('Message') ? 120_000 : 15_000 ), }); ``` ### Technical Analysis The `youmind.base_url` con ...[truncated 2323 chars]- Remediation
View remediation