T09 · Insecure Skill Coding Practices
Error
- Location
scripts/launch_workbench.py:204- Finding
Gateway Bearer Credential Sent to an Unvalidated Configurable URL
- Content
View full analysis
str: """Resolve the server-only Gateway bridge key for the Node child process.""" return ( args.gateway_api_key.strip() or _clean_env("WORKBENCH_GATEWAY_API_KEY") or _clean_env("API_SERVER_KEY") or _clean_env("HERMES_GATEWAY_API_KEY") or _clean_env("AI_GATEWAY_API_KEY") ) def _gateway_models_url(base_url: str) -> str: """Build a models URL while accepting bases with or without /v1.""" normalized = base_url.rstrip("/") return f"{normalized}/models" if normalized.endswith("/v1") else f"{normalized}/v1/models" def _is_hermes_gateway_base(base_url: str, api_key: str) -> bool: """Return true when a base URL looks like the Hermes Gateway API.""" if not base_url or not api_key: return False request = urllib.request.Request( _gateway_models_url(base_url), headers={"Authorization": f"Bearer {api_key}"}, method="GET", ) try: with urllib.request.urlopen(request, timeout=4) as response: body = response.read(10000).decode("utf-8", errors="replace") return response.status == 200 and "hermes-agent" in body except (OSError, urllib.error.URLError, urllib.error.HTTPError): return False def _resolve_gateway_base_url(args: argparse.Namespace, api_key: str) -> str: """Resolve a Hermes Gateway URL and avoid direct model endpoints.""" configured = args.gateway_base_url.strip() or _clean_env("HERMES_GATEWAY_BASE_URL") if _is_hermes_gateway_base(configured, api_key): return configured for candidate in ("http://127.0.0.1:8642", "http://localhost:8642", "http://127.0.0.1:8643"): if _is_hermes_gateway_ ...[truncated 2402 chars]- Remediation
View remediation