T09 · Insecure Skill Coding Practices
Error
- Location
odoo_skill/config.py:61- Finding
Odoo API Keys Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
xmlrpc.client.ServerProxy: """``/xmlrpc/2/common`` endpoint (lazy, cached).""" if self._common is None: self._common = xmlrpc.client.ServerProxy( f"{self.config.url}/xmlrpc/2/common", allow_none=True, ) return self._common @property def models(self) -> xmlrpc.client.ServerProxy: """``/xmlrpc/2/object`` endpoint (lazy, cached).""" if self._models is None: self._models = xmlrpc.client.ServerProxy( f"{self.config.url}/xmlrpc/2/object", allow_none=True, ) return self._models ``` `odoo_skill/client.py:128-134`: ```python uid = self.common.authenticate( self.config.db, self.config.username, self.config.api_key, {}, ) ``` `odoo_skill/client.py:174-182`: ```python return self.models.execute_kw( self.config.db, self.uid, self.config.api_key, model, method, list(args), kwargs if kwargs else {}, ) ``` ### Technical Analysis Configuration validation explicitly accepts both `http://` and `https://` URLs. The resulting URL is used directly to construct XML-RPC endpoints. Both authentication and every authenticated model operation include the reusable Odoo API key in the XML-RPC request. When a non-loopback HTTP endpoint is configured, transport encryption and server authentica ...[truncated 1894 chars]- Remediation
View remediation