T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:209- Finding
Bearer Token and User Content Can Be Sent to an Untrusted or Unencrypted API Host
- Content
View full analysis
str: return f"{self.host}/api/open/office/v2" def _request(self, method: str, path: str, payload: Optional[Dict[str, Any]] = None) -> Dict[str, Any]: url = f"{self.base_url}{path}" body = None headers = { "Authorization": f"Bearer {self.token}", "Accept": "application/json", } if payload is not None: body = json.dumps(payload).encode("utf-8") headers["Content-Type"] = "application/json" req = request.Request(url, data=body, headers=headers, method=method) try: with request.urlopen(req, timeout=self.REQUEST_TIMEOUT) as resp: ``` The same destination and credential values can be supplied directly through command-line arguments: ```python parser.add_argument("--host", help="覆盖 RACCOON_API_HOST") parser.add_argument("--token", help="覆盖 RACCOON_API_TOKEN") ``` ### Technical Analysis The client accepts an API host from the `RACCOON_API_HOST` environment variable or the `--host` command-line option without validating its scheme or destination. The supplied bearer token is then attached to every request made to that host. There is no enforcement that: - The destination uses HTTPS. - The destination belongs to the documented `xiaohuanxiong.com` service. - The destination is not localhost, a private network address, or another untrusted endpoint. - The URL does not contain unexpected components such as embedded credentials. Sending presenta ...[truncated 1757 chars]- Remediation
View remediation