T09 · Insecure Skill Coding Practices
Error
- Location
- cdisc_client.py:58
- Finding
- Overbroad Credential Discovery Can Disclose an Unrelated API Key<![CDATA[ ## Vulnerability Details **File Location**: `cdisc_client.py:58-79`, with credential transmission at `cdisc_client.py:47-52` and `cdisc_client.py:153` **Vulnerability Type**: Overbroad credential selection and unintended secret disclosure **Risk Level**: High ### Vulnerable Code ```python def _load_api_key(self) -> Optional[str]: """从环境变量或 TOOLS.md 加载 API Key""" # 优先环境变量 if os.getenv("CDISC_API_KEY"): return os.getenv("CDISC_API_KEY") # 尝试从 TOOLS.md 读取 tools_path = Path(__file__).parent.parent.parent / "TOOLS.md" if tools_path.exists(): content = tools_path.read_text(encoding="utf-8") for line in content.split("\n"): # 支持格式：**API Key**: `xxx` 或 - API Key: xxx if "API Key" in line and "`" in line: # 提取反引号中的内容 import re match = re.search(r'`([a-zA-Z0-9]{32,})`', line) if match: return match.group(1) elif "API Key" in line and ":" in line: key = line.split(":", 1)[1].strip().strip("`'\"") if key and len(key) >= 32: return key return None ``` The selected value is installed as the API credential and transmitted to CDISC: ```python self.headers = { "api-key": self.api_key, "Accept": "application/json" } self.session = requests.Session() self.session.headers.update(self.headers) ``` ```python response = self.session.get(url, params=params, timeout=30) ``` ### Technical Analysis The fallback parser scans a shared `TOOLS.md` file and accepts the first line that merely contains the generic text `API Key`. It does not verify that the line belongs to a dedicated `CDISC API` section and does not reject ambiguous or duplicate credential entries. Consequently, a key belonging to another service can be selected if it appears before the intended CDISC credential and satisfies the minimum length or regular-expression requi ...[truncated 1666 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the dedicated `CDISC_API_KEY` environment variable or a CDISC-specific configuration file. 2. If `TOOLS.md` support is retained, parse only an exact `## CDISC API` section and an exact `API Key` field within that section. 3. Reject missing, duplicate, or ambiguous CDISC credential entries instead of selecting the first generic match. 4. Resolve the documented configuration path explicitly and verify that the implementation and documentation reference the same file. 5. Avoid scanning unrelated configuration sections for secrets. 6. Add tests covering multiple API keys, duplicate CDISC sections, malformed entries, and configuration-path resolution. 7. Document the external destination to which the credential will be sent and prioritize the environment variable over shared plaintext configuration. ]]>