T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:59- Finding
Sensitive biomedical terms and API credentials are transmitted in URL query strings
- Content
View full analysis
List[Dict]: """Search UMLS for concepts.""" if not self.api_key: return [] params = { "string": term, "apiKey": self.api_key, "pageSize": str(page_size) } if sabs: params["sabs"] = ",".join(sabs) response = self._make_request("/search/current", params) ``` ```python def search(self, term: str) -> List[Dict]: """Search MeSH descriptors.""" encoded_term = urllib.parse.quote(term) url = f"{self.BASE_URL}/lookup/descriptor?label={encoded_term}" response = self._make_request(url) ``` ### Technical Analysis The UMLS client places both the user-provided biomedical term and the UMLS API key in an HTTPS URL query string. The MeSH client likewise places the biomedical term in a URL query string. HTTPS protects the request while it is in transit, but query strings can still be recorded by local proxies, enterprise gateways, reverse proxies, monitoring products, browser or HTTP diagnostics, server access logs, and exception telemetry. An API key in a query string therefore has a broader exposure surface than a credential carried in an authorization header. Biomedical terms may also contain protected health information when derived from clinical records. Remote access is explicitly enabled through `--use-api`, and the destinations are fixed official NLM domains. Consequently, this behavior is necessary for the optional external lookup feature and is not covert exfiltration. However, transmitting raw clinica ...[truncated 1539 chars]- Remediation
View remediation