T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bricklink_cli.py:58- Finding
Unrestricted API Base URL Can Disclose OAuth Material and Private Marketplace Data
- Content
View full analysis
Any: method = method.upper() params = clean_params(params or {}) url = f"{self.base_url}{path}" if params: url = f"{url}?{urllib.parse.urlencode(params, doseq=True)}" data = None headers = {"Accept": "application/json"} if body is not None: data = json.dumps(body, separators=(",", ":")).encode("utf-8") headers["Content-Type"] = "application/json" headers["Authorization"] = self.oauth_header(method, url) request = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(request, timeout=self.timeout) as response: raw = response.read().decode("utf-8") ``` ```python def add_common(parser: argparse.ArgumentParser) -> None: parser.add_argument("--base-url", default=os.getenv("BRICKLINK_API_BASE_URL", DEFAULT_BASE_URL), help="BrickLink API base URL") parser.add_argument("--timeout", type=int, default=READ_TIMEOUT_SECONDS, help="HTTP timeout in seconds") ``` ### Technical Analysis The API destination is controlled through either the `--base-url` command-line argument or the `BRICKLINK_API_BASE_URL` environment variable. No validation restricts the scheme, hostname, port, user-information component, or final destination. The client creates an OAuth 1.0 Authorization header for the resulting URL and sends the request to it. That header contains the OAuth consumer key, token value, nonce, timestamp, signature method, and request signature. OAuth consumer and token secrets are not directly placed in the header, but the exposed token identifier and signed request remain sensitive authen ...[truncated 1973 chars]- Remediation
View remediation