T09 · Insecure Skill Coding Practices
Error
- Location
scripts/easydoc_extract.py:104- Finding
Arbitrary API Base URL Allows Disclosure of Documents and API Credentials
- Content
View full analysis
Dict: url = f"{base_url.rstrip('/')}{SUBMIT_PATH}" form_fields: List[Tuple[str, str]] = [("mode", mode)] if mode in UNIVERSAL_MODES: if custom_fields: properties = {field: {"type": "string"} for field in custom_fields} schema = json.dumps( {"type": "object", "properties": properties}, ensure_ascii=False ) form_fields.append(("json_schema", schema)) elif custom_prompt: form_fields.append(("prompt_cus", custom_prompt)) payload, boundary = encode_multipart( fields=form_fields, files=[(FILE_FIELD, fp) for fp in file_paths], ) headers = { "api-key": api_key, "Content-Type": f"multipart/form-data; boundary={boundary}", } return http_json("POST", url, headers=headers, body=payload, timeout=timeout) ``` ```python def query_task( api_key: str, base_url: str, task_id: str, timeout: int = 60, retries: int = 0, ) -> Dict: path = RESULT_PATH.format(task_id=task_id) url = f"{base_url.rstrip('/')}{path}" headers = {"api-key": api_key} return http_json("GET", url, headers=headers, timeout=timeout, retries=retries) ``` ```python api_key = resolve_api_key(args.api_key) base_url = args.base_url.strip() or BASE_URL ``` ### Technical Analysis The helper accepts an unrestricted ...[truncated 2453 chars]- Remediation
View remediation