T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tbotjson.py:319- Finding
Webhook secret is printed and transmitted to a caller-controlled destination
- Content
View full analysis
Dict[str, str]: """Load the first .env we can find from candidate runtime dirs.""" for d in _candidate_runtime_dirs(): env_path = d / ".env" if env_path.exists() and env_path.is_file(): return _parse_dotenv(env_path) return {} def _resolve_webhook_key(cli_key: str) -> str: if cli_key: return cli_key env_key = os.getenv("WEBHOOK_KEY", "").strip() if env_key: return env_key dotenv = _discover_runtime_env() for k in ("WEBHOOK_KEY", "TBOT_WEBHOOK_KEY", "TVWB_KEY", "TV_WEBHOOK_KEY"): v = (dotenv.get(k) or "").strip() if v: return v unique_key = _resolve_unique_key(dotenv) if unique_key: return _generate_webhook_key(unique_key) for k, v in dotenv.items(): if re.search(r"webhook", k, re.I) and re.search(r"key", k, re.I) and v.strip(): return v.strip() return "" def _resolve_unique_key(dotenv: Dict[str, str]) -> str: unique_key = os.getenv("TVWB_UNIQUE_KEY", "").strip() if unique_key: return unique_key unique_key = (dotenv.get("TVWB_UNIQUE_KEY") or "").strip() if unique_key: return unique_key for d in _candidate_runtime_dirs(): key_path = d / ".keyfile" if key_path.exists() and key_path.is_file(): try: return key_path.read_text().strip() except Exception: continue return "" def post_json(url: str, payload: Dict[str, Any]) -> Tuple[int, str]: data = json.dumps(payload).encode("utf-8") req = request.Request( url, data=data, headers={"Content-Type": "application/json"}, method="POST", ...[truncated 2965 chars]- Remediation
View remediation