T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect_feeds.py:219- Finding
Feed credentials may be transmitted over insecure or attacker-controlled connections
- Content
View full analysis
Request: headers = {"User-Agent": USER_AGENT} if source.headers: headers.update(source.headers) if source.username and source.password: basic_token = base64.b64encode( f"{source.username}:{source.password}".encode("utf-8") ).decode("ascii") headers["Authorization"] = f"Basic {basic_token}" return Request(source.url, headers=headers) def fetch_feed(source: SourceConfig) -> bytes: request = build_request(source) ssl_context = None if not source.verify_ssl: ssl_context = ssl._create_unverified_context() with urlopen(request, context=ssl_context, timeout=30) as response: return response.read() ``` ### Technical Analysis Feed URLs, credentials, and the `verify_ssl` option are loaded directly from workspace configuration. The code does not require HTTPS when Basic authentication is enabled. It also permits certificate verification to be disabled through `verify_ssl=false`. Base64 is the encoding required by HTTP Basic authentication; it is not encryption. Anyone able to observe a plaintext HTTP connection can recover the username and password. When TLS certificate verification is disabled, an active network attacker can impersonate the feed server and obtain the same credentials. The Base64 value is placed in an HTTP Authorization header and is not written to stdout. T ...[truncated 1102 chars]- Remediation
View remediation