T09 · Insecure Skill Coding Practices
Error
- Location
rurussian_mcp/config.py:5- Finding
Bearer credentials and learner content can be transmitted to arbitrary or plaintext API endpoints
- Content
View full analysis
str: endpoint = endpoint.strip() if endpoint.startswith("https://") or endpoint.startswith("http://"): return endpoint if not endpoint.startswith("/"): endpoint = f"/{endpoint}" return f"{self.api_base_url}{endpoint}" ``` ```python # rurussian_mcp/services/auth_service.py:31-38 def get_headers(self, include_auth: bool = True) -> dict[str, str]: headers = { "User-Agent": self.user_agent, "Content-Type": "application/json", } if include_auth and self.api_key: headers["Authorization"] = f"Bearer {self.api_key}" return headers ``` ### Technical Analysis `RURUSSIAN_API_URL` is accepted without validating its scheme, hostname, port, or origin. The endpoint normalization logic explicitly permits both HTTP and HTTPS URLs. Authentic ...[truncated 2328 chars]- Remediation
View remediation