T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generation_api.py:101- Finding
API Key Disclosure Through Cross-Origin HTTP Redirects
- Content
View full analysis
Dict[str, Any]: url = f"{self.BASE_URL}{path}" try: resp = requests.post(url, headers=self.headers, json=payload, timeout=30) resp.raise_for_status() result = resp.json() if result.get("code") != 200: raise Exception(result.get("msg", result.get("message", "未知错误"))) return result except requests.exceptions.RequestException as e: raise Exception(f"请求失败: {str(e)}") def query_task(self, task_id: str) -> Dict[str, Any]: """查询任务状态""" url = f"{self.BASE_URL}{self.QUERY_TASK}" try: resp = requests.get( url, headers=self.headers, params={"task_id": task_id}, timeout=30 ) ``` ### Technical Analysis The Skill must transmit `GIGGLE_API_KEY` to `https://giggle.pro` to authenticate video-generation operations, so sending the credential to that declared service is necessary for the advertised functionality. However, the credential is placed in the custom `x-auth` header, and both Requests calls use the library's default redirect behavior. Redirects are followed automatically because `allow_redirects=False` is not specified. Requests has special handling for removing the standard `Authorization` header when redirecting across origins, but an application-defined authentication header such as `x-auth` does not receive equivalent protection automatically. Consequently, a cross-origin redirect may cause the API key to be sent to the redirected host. This exceeds minimum ...[truncated 1429 chars]- Remediation
View remediation