T09 · Insecure Skill Coding Practices
Error
- Location
client.py:639- Finding
Unrestricted Base URL Override Can Redirect Credentials and Authenticated Requests
- Content
View full analysis
str: if path.startswith("http://") or path.startswith("https://"): return path return f"{self.base_url}{path}" def _build_request_headers(self, *, method: str, referer: str | None = None) -> dict[str, str]: headers: dict[str, str] = {} if self.browser_headers: headers.update( { "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Dest": "empty", } ) if referer: headers["Referer"] = self._url(referer) if method.upper() == "POST": headers["Origin"] = self.base_url headers["Content-Type"] = "application/x-www-form-urlencoded; charset=UTF-8" return headers @staticmethod def _raise_if_risk_control_redirect(resp: requests.Response) -> None: if "error.html" in resp.url: raise RuntimeError( "12306 返回 error.html，通常是触发了风控或访问限制。" "请在可访问 12306 的网络环境重试，或重新登录，或降低请求频率。" ) def _send_request( self, method: str, path: str, *, params: dict[str, Any] | None = None, data: dict[str, Any] | None = None, referer: str | None = None, expect_json: bool = True, ) -> requests.Response: resp = self.session.request( method=method.upper(), url=self._url(path), params=params, data=data, headers=self._build_request_headers(method=method, referer=referer), timeout=self.timeout, ) ``` ```python parser.add_argument("--base-url", default=BASE_URL, help="12306 base URL") ``` ```python client = KyfwClient( base_url=args.base_url, timeout=args.timeout, ...[truncated 3058 chars]- Remediation
View remediation