T09 · Insecure Skill Coding Practices
Warning
- Location
a2f_example.py:28- Finding
Authentication Headers Can Be Forwarded to a Caller-Controlled API Origin
- Content
View full analysis
Dict: """Extract features from PDF""" headers = get_headers(BASE_HEADERS) async with httpx.AsyncClient() as client: with open(pdf_path, "rb") as f: files = {"files[0]": (pdf_path, f, "application/pdf")} data = {"role": role, "loop_count": 2, "gen_method": "qwen", "openclaw": 1} response = await client.post(f"{self.api_base}/archiveData", data=data, files=files, headers=headers) return response.json() ``` ```python headers = get_headers(BASE_HEA ...[truncated 2558 chars]- Remediation
View remediation
str: parsed = urlsplit(api_base) port = parsed.port or 443 if parsed.username or parsed.password: raise ValueError("Credentials are not permitted in the API URL") if (parsed.scheme, parsed.hostname, port) not in ALLOWED_API_ORIGINS: raise ValueError("Untrusted API origin") return api_base.rstrip("/") ``` The validated origin should then be stored, and `get_headers()` should only be called for requests to that origin. ]]>