T09 · Insecure Skill Coding Practices
Error
- Location
scripts/common.py:84- Finding
Bearer Credentials and Uploaded Documents May Be Transmitted over Insecure HTTP or Cross-Origin Redirects
- Content
View full analysis
str: base_url = (cli_base_url or "").strip() or _require_env_var(RAGFLOW_API_URL_ENV) parsed = urllib.parse.urlsplit(base_url) if not parsed.scheme or not parsed.netloc: raise ConfigError( f"Invalid {RAGFLOW_API_URL_ENV}. Use an absolute URL such as http://127.0.0.1:9380." ) return base_url.rstrip("/") ``` ```python def request_json( url: str, api_key: str, *, method: str = "GET", body: bytes | None = None, content_type: str | None = None, accept: str = "application/json", ) -> dict[str, Any]: headers = {"Authorization": f"Bearer {api_key}"} if accept: headers["Accept"] = accept if content_type: headers["Content-Type"] = content_type request_obj = urllib.request.Request(url, headers=headers, data=body, method=method) try: with urllib.request.urlopen(request_obj, timeout=HTTP_TIMEOUT) as response: return decode_json_response(response.read()) except urllib.error.HTTPError as exc: body_bytes = exc.read() response_payload = decode_json_body(body_bytes) response_text = decode_response_text(body_bytes) message = extract_error_message(body_bytes) if message: raise ApiError( message, http_status=exc.code, api_code=response_payload.get("code") if isinstance(response_payload, dict) else None, response_payload=response_payload, response_body=response_text, ) from None raise ApiError( f"HTTP r ...[truncated 4281 chars]- Remediation
View remediation