T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lg_api_tool.py:90- Finding
LG Personal Access Token Can Be Sent to an Arbitrary API Server
- Content
View full analysis
cache file > route API.""" if API_SERVER: return API_SERVER if os.path.exists(API_SERVER_CACHE): with open(API_SERVER_CACHE, "r") as f: server = f.read().strip() if server: return server ``` ```python def api_request(method, path, payload=None, snapshot=None): base_url = get_base_url() url = f"{base_url}{path}" headers = get_device_headers(snapshot) log_debug(f"API Request: {method} {url}") # Mask PAT in debug logs debug_headers = { k: (v if k != "Authorization" else "Bearer ***") for k, v in headers.items() } log_debug(f"Headers: {json.dumps(debug_headers)}") try: res = requests.request(method, url, headers=headers, json=payload, timeout=15) log_debug(f"API Response Status: {res.status_code}") return res.json() ``` From the generated control-script template in `scripts/generate_control_script.py`: ```python # API Server Priority: env var > .api_server_cache > default API_SERVER_CACHE = os.path.join(script_dir, ".api_server_cache") if os.getenv("LG_API_SERVER"): BASE_URL = os.getenv("LG_API_SERVER") elif os.path.exists(API_SERVER_CACHE): with open(API_SERVER_CACHE, "r") as f: BASE_URL = f.read().strip() else: BASE_URL = "https://api-kic.lgthinq.com" ``` ```python headers = {{ "Authorization": f"Bearer {{PAT}}", "x-api-key": API_KEY, "x-client-id": CLIENT_ID, "x-country": COUNTRY, "x-message-id": MESSAGE_ID, "Content-Type": "application/json", }} url = f"{{BASE_URL}}{{path}}" headers = get_headers(snapshot) try: res ...[truncated 2004 chars]- Remediation
View remediation