T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aster_readonly_client.py:20- Finding
Configurable API Base URL Allows Credential Disclosure and Exchange Response Spoofing
- Content
View full analysis
dict: params = dict(params or {}) for attempt in range(max_retries + 1): try: req_params = dict(params) headers = {} if method == "GET": if private: if not API_KEY or not API_SECRET: raise RuntimeError("missing ASTER_API_KEY/ASTER_API_SECRET") req_params["timestamp"] = _timestamp() req_params["signature"] = _sign(req_params) headers["X-MBX-APIKEY"] = API_KEY query = urllib.parse.urlencode(req_params) url = BASE_URL + path + (("?" + query) if query else "") req = urllib.request.Request(url, headers=headers, method="GET") elif method == "DELETE": if private: if not API_KEY or not API_SECRET: raise RuntimeError("missing ASTER_API_KEY/ASTER_API_SECRET") req_params["timestamp"] = _timestamp() req_params["signature"] = _sign(req_params) headers["X-MBX-APIKEY"] = API_KEY query = urllib.parse.urlencode(req_params) url = BASE_URL + path + "?" + query req = urllib.request.Request(url, headers=headers, method="DELETE") else: headers["Content-Type"] = "application/x-www-form-urlencoded" if private: if not API_KEY o ...[truncated 2802 chars]- Remediation
View remediation