T09 · Insecure Skill Coding Practices
Warning
- Location
sdk/python/videomp3word_client.py:9- Finding
Python SDK Sends Bearer Credentials Without Enforcing HTTPS
- Content
View full analysis
dict: payload = { "media_url": media_url, "outputs": list(outputs), "mode": mode, "export_formats": list(export_formats or ["json"]), } if metadata: payload["metadata"] = metadata request = urllib.request.Request( url=f"{self.base_url}/video_to_knowledge", data=json.dumps(payload).encode("utf-8"), headers=self._headers(), method="POST", ) with urllib.request.urlopen(request, timeout=self.timeout) as response: return json.loads(response.read().decode("utf-8")) def _headers(self) -> dict: headers = {"Content-Type": "application/json"} if self.bearer_token: headers["Authorization"] = f"Bearer {self.bearer_token}" return headers ``` ### Technical Analysis The Python SDK accepts an unrestricted caller-provided `base_url` and attaches the bearer token to requests made to that URL. It does not verify that a non-local endpoint uses HTTPS. Consequently, a URL beginning with `http://` can cause the authorization credential, media URL, metadata, and request parameters to be transmitted without transport encryption. The TypeScript service configuration applies HTTPS requirements to credential-bearing upstream services, but the distributed Python SDK does not provide equivalent protection. The network transmission itself ...[truncated 1366 chars]- Remediation
View remediation