T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ninebot_query.py:51- Finding
Configurable Network Destination Can Disclose the Ninebot API Key
- Content
View full analysis
str: section_url = (cfg.get(section) or {}).get("base_url") if section_url: return section_url return cfg.get("base_url", "") ``` ```python def inject_api_key_header(cfg: Dict[str, Any], headers: Dict[str, str], api_key: str): auth_cfg = cfg.get("auth") or {} header_name = auth_cfg.get("api_key_header") or "x-api-key" prefix = auth_cfg.get("api_key_prefix") or "" headers[header_name] = f"{prefix}{api_key}" def list_devices(cfg: Dict[str, Any], api_key: str, lang: str): url = get_base_url(cfg, "devices").rstrip("/") + cfg["devices"]["path"] payload_tpl = cfg["devices"].get("payload") or {} payload = { k: (v.format(api_key=api_key, lang=lang) if isinstance(v, str) else v) for k, v in payload_tpl.items() } headers: Dict[str, str] = {} if api_key: inject_api_key_header(cfg, headers, api_key) payload_to_send = None if cfg["devices"]["method"].upper() == "GET" else payload res = http_request(cfg["devices"]["method"], url, headers=headers, payload=payload_to_send) devices = deep_get(res, cfg["devices"]["list_path"]) or [] return devices def get_device_info(cfg: Dict[str, Any], api_key: str, sn: str): path = cfg["device_info"]["path"].replace("{sn}", urllib.parse.quote(sn)) url = get_base_url(cfg, "device_info").rstrip("/") + path payload_tpl = cfg["device_info"].get("payload") or {} payload = { k: (v.format(api_key=api_key, sn=sn) if isinstance(v, str) else v) for k, v in payload_tpl.items() } headers: Dict[str, str] = {} if api_key: inject_api_key_header(cfg, headers, api_key) res = http_request(cfg["device_inf ...[truncated 2649 chars]- Remediation
View remediation