T09 · Insecure Skill Coding Practices
Error
- Location
yesapi_client.py:43- Finding
API Credentials Can Be Exfiltrated Through an Untrusted Configurable Domain
- Content
View full analysis
Dict[str, Any]: """发起API请求""" if params is None: params = {} # 添加必要参数 params['app_key'] = self.config.app_key params['_timestamp'] = int(time.time()) # 静态签名 sign = self.config.sign if sign: params['sign'] = sign url = f"{self.config.domain}/?s={service}" try: if method.upper() == "GET": response = self.session.get(url, params=params, timeout=30) else: response = self.session.post(url, params=params, json=data, timeout=30) ``` ### Technical Analysis The request destination is taken directly from `YESAPI_DOMAIN` without validating its scheme, hostname, port, or relationship to the legitimate YesApi service. Every request then adds the application key and reusable static signing value to the URL query parameters. An attacker who can influence the environment or configuration can set `YESAPI_DOMAIN` to an attacker-controlled server. Any subsequent API operation will transmit both `YESAPI_APP_KEY` and `YESAPI_SIGN` to that server. If an `http://` destination is configured, the values can also be intercepted in transit. Even w ...[truncated 1663 chars]- Remediation
View remediation