T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/core/vephone_client.py:544- Finding
Unvalidated Pre-Signed Edge URL Permits Plaintext or Untrusted Data Transmission
- Content
View full analysis
str: preferred_keys = { "presignededgeurl", "presignedurl", "edgeurl", "url", } def walk(node: Any) -> Optional[str]: if isinstance(node, dict): for key, value in node.items(): if ( key.lower() in preferred_keys and isinstance(value, str) and value.startswith(("http://", "https://")) ): return value for value in node.values(): found = walk(value) if found: return found elif isinstance(node, list): for value in node: found = walk(value) if found: return found return None url = walk(payload) if not url: raise ValueError("GetPreSignedEdgeURL response missing pre-signed URL") return url ``` The extracted scheme and authority are then used directly: ```python def _edge_request( self, method: str, url: str, headers: Optional[Dict[str, str]] = None, body: Optional[bytes] = None, timeout: int = 30, ) -> Dict[str, Any]: parsed = urllib.parse.urlsplit(url) base_url = f"{parsed.scheme}://{parsed.netloc}" path = parsed.path or "/" query_pairs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True) query_params = {key: value for key, value in query_pairs} status, payload, ...[truncated 4153 chars]- Remediation
View remediation