T09 · Insecure Skill Coding Practices
Warning
- Location
runtime/mysearch/clients.py:2755- Finding
API Credentials Can Be Transmitted to Arbitrary Non-TLS Endpoints
- Content
View full analysis
str: return url.rstrip("/") def _provider_base_url( *, explicit_names: tuple[str, ...], proxy_base_url: str, default: str, ) -> str: explicit = _get_str(*explicit_names) if explicit: return _normalize_base_url(explicit) if proxy_base_url: return _normalize_base_url(proxy_base_url) return _normalize_base_url(default) ``` ```python # runtime/mysearch/clients.py:2755-2789 def _request_json( self, *, provider: ProviderConfig, method: str, path: str, payload: dict[str, Any], key: str, base_url: str | None = None, timeout_seconds: int | None = None, ) -> dict[str, Any]: headers: dict[str, str] = {} body = dict(payload) if provider.auth_mode == "bearer": token = key if not provider.auth_scheme else f"{provider.auth_scheme} {key}" headers[provider.auth_header] = token elif provider.auth_mode == "body": body[provider.auth_field] = key else: raise MySearchError(f"unsupported auth mode for {provider.name}: {provider.auth_mode}") url = f"{(base_url or provider.base_url)}{path}" headers.setdefault("Content-Type", "application/json") headers.setdefault("User-Agent", "MySearch/0.2") request_body = json.dumps(body).encode("utf-8") request = Request( url, data=request_body, headers=headers, method=method.upper(), ) try: with urlopen( request, timeout=timeout_seconds or self.config.timeout_seconds, ) as response: status_code = response.status response_text = respo ...[truncated 2782 chars]- Remediation
View remediation
str: parsed = urlparse(url) if parsed.username or parsed.password: raise MySearchError("endpoint URLs must not contain credentials") if not parsed.hostname: raise MySearchError("endpoint URL must contain a hostname") loopback_names = {"localhost", "127.0.0.1", "::1"} if parsed.scheme != "https": if parsed.scheme != "http" or parsed.hostname.lower() not in loopback_names: raise MySearchError( "HTTPS is required for remote credential-bearing endpoints" ) return url.rstrip("/") ``` ]]>