T09 · Insecure Skill Coding Practices
Error
- Location
scripts/invoke_ezer_api.py:14- Finding
Bearer Token Can Be Transmitted to an Arbitrary or Unencrypted Endpoint
- Content
View full analysis
Dict[str, str]: headers = {"Content-Type": "application/json"} token = os.environ.get("EZER_BEARER_TOKEN", "").strip() if token: headers["Authorization"] = f"Bearer {token}" return headers def request_json(method: str, url: str, payload: Dict[str, Any] | None = None) -> Tuple[int, Dict[str, Any]]: data = None if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request(url=url, method=method, data=data, headers=make_headers()) ``` ```python base_url = os.environ.get("EZER_API_BASE_URL", "").strip().rstrip("/") if not base_url: print("Missing required env: EZER_API_BASE_URL", file=sys.stderr) return 2 ``` ```python create_url = f"{base_url}/api/tasks" status, created = request_json("POST", create_url, create_payload) if status != 202: print(json.dumps({"error": "create_task_failed", "status": status, "response": created}, ensure_ascii=False), file=sys.stderr) return 1 task_id = created.get("task_id") if not task_id: print(json.dumps({"error": "missing_task_id", "response": created}, ensure_ascii=False), file=sys.stderr) return 1 result_url = f"{base_url}/api/tasks/{task_id}/result" deadline = time.time() + args.timeout_sec while True: status, result = request_json("GET", result_url) ``` The project documentation explicitly permits an unencrypted endpoint: ```markdown - `EZER_API_BASE_URL` example: `http://127.0.0.1:8008` - `EZER_BEARER_TOKEN` optional if API auth is disabled ``` ### Technical Analysis `EZER_API_BASE_URL` is read directly from the environment and used as the destination fo ...[truncated 2636 chars]- Remediation
View remediation