T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_benchmark.py:53- Finding
Specification-Controlled Credential Disclosure to Arbitrary HTTPS Endpoints
- Content
View full analysis
bool: """Basic safety checks. - Require https - Block raw IPs - Block localhost This is not a complete security solution, but it prevents the most common foot-guns that trigger security scanners and protects against accidental exfiltration to an IP/short endpoint. """ if not base_url: return False base_url = base_url.strip() if not base_url.startswith('https://'): return False lowered = base_url.lower() if 'localhost' in lowered or '127.0.0.1' in lowered or '0.0.0.0' in lowered: return False # crude IP check (blocks http(s)://...) import re if re.search(r'https://\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?(?:/|$)', lowered): return False return True def run_single_model(spec: dict, model: str, run_dir: Path, run_id: str): base_url = spec.get('base_url') or os.environ.get('BENCHMARK_BASE_URL') or '' if not _is_safe_base_url(base_url): raise Syste ...[truncated 3243 chars]- Remediation
View remediation