T09 · Insecure Skill Coding Practices
Error
- Location
cdisc_client.py:58- Finding
Overbroad Credential Discovery Can Disclose an Unrelated API Key
- Content
View full analysis
Optional[str]: """从环境变量或 TOOLS.md 加载 API Key""" # 优先环境变量 if os.getenv("CDISC_API_KEY"): return os.getenv("CDISC_API_KEY") # 尝试从 TOOLS.md 读取 tools_path = Path(__file__).parent.parent.parent / "TOOLS.md" if tools_path.exists(): content = tools_path.read_text(encoding="utf-8") for line in content.split("\n"): # 支持格式：**API Key**: `xxx` 或 - API Key: xxx if "API Key" in line and "`" in line: # 提取反引号中的内容 import re match = re.search(r'`([a-zA-Z0-9]{32,})`', line) if match: return match.group(1) elif "API Key" in line and ":" in line: key = line.split(":", 1)[1].strip().strip("`'\"") if key and len(key) >= 32: return key return None ``` The selected value is installed as the API credential and transmitted to CDISC: ```python self.headers = { "api-key": self.api_key, "Accept": "application/json" } self.session = requests.Session() self.session.headers.update(self.headers) ``` ```python response = self.session.get(url, params=params, timeout=30) ``` ### Technical Analysis The fallback parser scans a shared `TOOLS.md` file and accepts the first line that merely contains the generic text `API Key`. It does not verify that the line belongs to a dedicated `CDISC API` section and does not reject ambiguous or duplicate credential entries. Consequently, a key belonging to another service can be selected if it appears before the intended CDISC credential and satisfies the minimum length or regular-expression requi ...[truncated 1666 chars]- Remediation
View remediation