T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_ocsr.py:208- Finding
Unrestricted API Base URL Can Disclose Tokens and Molecular Images
- Content
View full analysis
Dict[str, Any]: """POST 到 /patent/api/v1/u/extractor/image/molecules，必须传有效 token（与 patsight 一致获取）。""" if not base_url: raise ValueError("Missing base URL. Set --base-url or PATSIGHT_BASE_URL.") base_url = base_url.rstrip("/") if "patent.xinsight-ai.com" in base_url and "/patent/api" not in base_url: base_url = f"{base_url}/patent/api" auth_token = get_valid_token(token=token, account=account, password=password) url = f"{base_url}/v1/u/extractor/image/molecules" params = {"request_id": request_id} files = [] handles = [] try: for path in images: fh = open(path, "rb") handles.append(fh) files.append(("image", (path.name, fh, guess_mime(path)))) files.append(("label", (None, "molvision"))) response = requests.post( url, params=params, files=files, headers={ "Accept": "application/json", "Authorization": auth_token, }, timeout=timeout, ) ``` The destination originates from an unrestricted command-line option or environment variable: ```python p.add_argument( "--base-url", default=DEFAULT_PATENT_BASE_URL, help="Patent API base URL (default: PATSIGHT_BASE_URL)", ) ``` ### Technical Analysis The script accepts any `--base-url` value without validating its scheme, host, port, resolved IP address, or redirect behavior. It then sends both the PatSight authoriz ...[truncated 2350 chars]- Remediation
View remediation