T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aurashot.py:83- Finding
Credentials and Sensitive Images Can Be Sent to an Arbitrary Host
- Content
View full analysis
str: return (args.base_url or os.environ.get("AURASHOT_BASE_URL") or DEFAULT_BASE_URL).rstrip("/") ``` ```python def upload_file(file_path: Path, api_key: str, base_url: str = DEFAULT_BASE_URL) -> str: """Upload a local image via AuraShot /v1/uploads and return the public URL.""" body, boundary = encode_multipart("file", file_path) req = request.Request( f"{base_url}/v1/uploads", data=body, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": f"multipart/form-data; boundary={boundary}", }, method="POST", ) opener = _build_url_opener() ``` ```python def make_request(method: str, url: str, api_key: str, payload: Optional[Dict[str, Any]] = None) -> Dict[str, Any]: body = json.dumps(payload).encode("utf-8") if payload is not None else None headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"} req = request.Request(url, data=body, headers=headers, method=method) opener = _build_url_opener() ``` ### Technical Analysis The API destination can be overridden through either the `--base-url` command-line option or the `AURASHOT_BASE_URL` environment variable. The value is only normalized by removing trailing slashes. The implementation does not enforce HTTPS, validate the hostname or port, or restrict the destination to an approved AuraShot origin. The selected base URL is then used for authenticated API requests and local image uploads. These requests include the AuraShot bearer token in the `Authorization` header. Upload requests also include the complete contents of the user-selected image, which may c ...[truncated 1735 chars]- Remediation
View remediation