T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pettracer_cli.py:41- Finding
Configurable REST API Origin Can Exfiltrate PetTracer Credentials and Bearer Tokens
- Content
View full analysis
str: """Return bearer token from env or by logging in.""" token = _env_first("PETTRACER_TOKEN") if token: return token username = username or _env_first("PETTRACER_USERNAME", "PETTRACER_EMAIL") password = password or _env_first("PETTRACER_PASSWORD") if not username or not password: raise PetTracerAuthError( "Missing credentials. Set PETTRACER_TOKEN or (PETTRACER_USERNAME/PETTRACER_EMAIL + PETTRACER_PASSWORD)." ) payload = {"login": username, "password": password} resp = _request("POST", LOGIN_ENDPOINT, json_body=payload, timeout_s=timeout_s, retries=retries) if not isinstance(resp, dict): raise PetTracerAuthError("Login response was not a JSON object.") token = resp.get("access_token") or resp.get("token") or resp.get("id_token") if not token: raise PetTracerAuthError("Login response did not contain an access token.") return str(token) def fetch_devices(*, token: str, timeout_s: int, retries: int) -> List[Dict[str, Any]]: ...[truncated 2573 chars]- Remediation
View remediation