T09 · Insecure Skill Coding Practices
Error
- Location
scripts/org_skill_cli.py:438- Finding
Bearer credentials can be transmitted to an unrestricted caller-controlled destination
- Content
View full analysis
None: if auth_mode == "none": return if auth_mode == "access": token = session.get("token") if not token: raise RuntimeError("当前 session 里没有 access token，请先 guest-generate 或 agent-login。") headers["authorization"] = f"Bearer {token}" return if auth_mode == "refresh": refresh_token = session.get("refreshToken") if not refresh_token: raise RuntimeError("当前 session 里没有 refreshToken，请先登录。") headers["RefreshToken"] = f"Bearer {refresh_token}" return raise ValueError(f"不支持的 auth_mode: {auth_mode}") ``` ```python def request_json( *, method: str, base_url: str, path: str, headers: dict[str, str], query: dict[str, Any] | None = None, body: dict[str, Any] | None = None, timeout: int = DEFAULT_TIMEOUT, ) -> Any: target_path = path if path.startswith("/") else f"/{path}" base = base_url.rstrip("/") url = f"{base}{target_path}" if query: encoded = urllib.parse.urlencode({k: v for k, v in query.items() if v is not None}) if encoded: url = f"{url}?{encoded}" data = None if body is not None: data = json.dumps(body, ensure_ascii=False).encode("utf-8") request = urllib.request.Request(url=url, data=data, method=method.upper()) for key, value in headers.items(): request.add_header(key, value) try: with urll ...[truncated 3996 chars]- Remediation
View remediation