T09 · Insecure Skill Coding Practices
Error
- Location
scripts/databricks_helper.py:52- Finding
Bearer Token Can Be Transmitted to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
tuple[str, str]: host = os.environ.get("DATABRICKS_HOST", "").rstrip("/") token = os.environ.get("DATABRICKS_TOKEN", "") if not host or not token: print("ERROR: DATABRICKS_HOST and DATABRICKS_TOKEN must be set.") print("") print("Setup:") print(" export DATABRICKS_HOST=https://adb-xxxx.azuredatabricks.net") print(" export DATABRICKS_TOKEN=dapiXXXXXXXXXXXXXXXX") sys.exit(1) return host, token def build_url(host: str, api_version: str, path: str, params: Optional[Dict[str, str]] = None) -> str: url = f"{host}/api/{api_version}/{path}" if params: safe_params = {k: str(v) for k, v in params.items() if v is not None} query = urlencode(safe_params, doseq=True) url = f"{url}?{query}" return url def api_get(host: str, token: str, path: str, params: Optional[Dict[str, str]] = None, api_version: str = "2.1") -> Dict: url = build_url(host, api_version, path, params) req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"}) try: with urllib.request.urlopen(req) as resp: return json.loads(resp.read()) except urllib.error.HTTPError as e: body = e.read().decode() print(f"HTTP {e.code}: {body}") sys.exit(1) def api_post(host: str, token: str, path: str, payload: Dict, api_version: str = "2.1") -> Dict: url = build_url(host, api_version, path) data = json.dumps(payload).encode() req = urllib.request.Request( url, data=data, headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"} ) try: with urllib.request.urlopen(req) as resp: body = resp.read() ...[truncated 2475 chars]- Remediation
View remediation