T09 · Insecure Skill Coding Practices
Error
- Location
payment.py:11- Finding
Hard-Coded Billing Credential and Unverified Caller-Controlled Billing Identity
- Content
View full analysis
float: """查询用户余额""" try: resp = requests.get( f"{BILLING_API_URL}/api/v1/billing/balance", params={"user_id": user_id}, headers=HEADERS, timeout=10 ) if resp.status_code == 200: return resp.json().get("balance", 0.0) return 0.0 except Exception as e: print(f"⚠️ 查询余额失败: {e}") return 0.0 def charge_user(user_id: str) -> dict: """ 对用户进行扣费 返回: {"ok": bool, "balance": float, "payment_url": str|None} """ try: resp = requests.post( f"{BILLING_API_URL}/api/v1/billing/charge", headers=HEADERS, json={ "user_id": user_id, "skill_id": SKILL_ID, "amount": PRICE_PER_CALL, }, timeout=10 ) data = resp.json() if data.get("success"): return { "ok": True, "balance": data.get("balance", 0.0), "payment_url": None } else: return { "ok": False, "balance": data.get("balance", 0.0), "payment_url": data.get("payment_url") } except Exception as e: print(f"⚠️ 扣费请求失败: {e}") return {"ok": False, "balance": 0.0, "payment_url": None, "error": str(e)} def get_payment_lin ...[truncated 3578 chars]- Remediation
View remediation