T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cleanup_dryrun.py:44- Finding
Harbor credentials can be transmitted to an untrusted or cleartext endpoint
- Content
View full analysis
Dict[str, str]: if not auth: raise ValueError("Authentication information is required") if auth.startswith("Bearer "): return {"Authorization": auth} elif ":" in auth: encoded = base64.b64encode(auth.encode()).decode() return {"Authorization": f"Basic {encoded}"} else: encoded = base64.b64encode(f"admin:{auth}".encode()).decode() return {"Authorization": f"Basic {encoded}"} def get_project_id(url: str, project: str, headers: Dict) -> int: r = requests.get( f"{url}/api/v2.0/projects", params={"name": project}, headers=headers, timeout=30 ) ``` ```python # scripts/compliance_check.py def get_headers(auth: str) -> Dict[str, str]: if ":" in auth: encoded = base64.b64encode(auth.encode()).decode() return {"Authorization": f"Basic {encoded}", "Content-Type": "application/json"} encoded = base64.b64encode(f"admin:{auth}".encode()).decode() return {"Authorization": f"Basic {encoded}", "Content-Type": "application/json"} ``` ```python # scripts/robot_account.py def get_project_id(url: str, project: str, headers: Dict) -> int: r = requests.get( f"{url}/api/v2.0/projects", params={"name": project}, headers=headers, timeout=15 ) ``` ### Technical Analysis All three scripts construct an `Authorization` header containing reusable Harbor credentials and send it to a caller-controlled `--url`. They do not validate the URL scheme, destination host, port, or redirect target. Base64 encoding is required by HTTP Ba ...[truncated 1444 chars]- Remediation
View remediation