T09 · Insecure Skill Coding Practices
Error
- Location
scripts/supabase_dataplane.py:276- Finding
Service-role credential disclosure through an attacker-controlled API endpoint
- Content
View full analysis
tuple[str, str, str | None, str | None]: endpoint = env("SUPABASE_URL") key = env("SUPABASE_SERVICE_ROLE_KEY") workspace_id: str | None = None branch_id: str | None = args.branch_id if not endpoint or not key: workspace_id, branch_id = resolve_workspace_and_branch(args) if not workspace_id: raise DataPlaneError( "workspace_id is required unless SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are set" ) if not endpoint: endpoint_payload = run_ve_aidap( "DescribeWorkspaceEndpoint", {"WorkspaceId": workspace_id, "BranchId": branch_id}, args.region, ) endpoint = extract_endpoint(endpoint_payload, args.endpoint_scheme) if not key: key_payload = run_ve_aidap( "DescribeAPIKeys", {"WorkspaceId": workspace_id, "BranchId": branch_id, "Limit": 100}, args.region, ) key = extract_api_key(key_payload, "service") return endpoint.rstrip("/"), key, workspace_id, branch_id def call_supabase_api( endpoint: str, api_key: str, path: str, method: str = "GET", json_data: Any | None = None, params: dict[str, Any] | None = None, content: bytes | None = None, timeout: float = 30.0, ) -> Any: url = f"{endpoint}{path}" if params: url = f"{url}?{urlencode(params, doseq=True)}" headers = { "apikey": api_key, "Authorization": f"Bearer {api_key}", } data = content if json_data is not None: data = json.dumps(json_data, ensure_ascii=False).encode("utf-8") headers["Content-Type"] = "application/json" for atte ...[truncated 2453 chars]- Remediation
View remediation