T09 · Insecure Skill Coding Practices
Error
- Location
script/monitor.py:62- Finding
Configurable Network Endpoints Can Receive Authentication Material
- Content
View full analysis
list: """Convert token symbols (e.g. 'BTC') to vsTokenId strings.""" token_ids = [] for symbol in symbols: body = json.dumps({"search": symbol}) headers = build_api_headers(api_key, secret_key, body) try: resp = requests.post( f"{api_base_url}/api/open/v1/vs-token/list", headers=headers, data=body, timeout=10, ) ``` ```python def run_market(config: dict) -> None: stream_base = config.get("streamBaseUrl", "https://stream.valuescan.ai") output_dir = config["outputDir"] params = build_stream_params(config["apiKey"], config["secretKey"]) resp = requests.get( f"{stream_base}/stream/market/subscribe", params=params, stream=True, timeout=None, ) ``` ```typescript async function resolveTokenIds(symbols: string[], apiKey: string, secretKey: string, apiBaseUrl: string): Promise { const tokenIds: string[] = []; for (const symbol of symbols) { const body = JSON.stringify({ search: symbol }); const headers = buildApiHeaders(apiKey, secretKey, body); try { const resp = await fetch(`${apiBaseUrl}/api/open/v1/vs-token/list`, { method: 'POST', headers, body, }); ``` ```typescript function runMarket(config: Config): void { const base = config.streamBaseUrl ?? 'https://stream.valuescan.ai'; const url = buildStreamUrl(base, '/stream/market/subscribe', config.apiKey, config.secretKey); const es = new EventSource(url); ``` ### Technical Analysis The API and stream base URL ...[truncated 1950 chars]- Remediation
View remediation