T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/finddata.py:23
- Finding
- API Key Exposure Through an Unrestricted Base URL## Vulnerability Details **File Location**: `scripts/finddata.py`, lines 23–31 and 38–42 **Vulnerability Type**: Credential disclosure through an attacker-controlled API origin **Risk Level**: Medium ### Vulnerable Code ```python def __init__( self, api_key: Optional[str] = None, base_url: Optional[str] = None, ): self.api_key = api_key or os.environ.get("FINDDATA_API_KEY", "") self.base_url = (base_url or os.environ.get("FINDDATA_BASE_URL", self.DEFAULT_BASE_URL)).rstrip("/") self.session = requests.Session() if self.api_key: self.session.headers["X-API-Key"] = self.api_key self.session.headers["Content-Type"] = "application/json" def query(self, question: str, strategy: str = "smart") -> dict: resp = self.session.post( f"{self.base_url}/query", json={"query": question, "strategy": strategy}, ) ``` The same credential-bearing session is also used by `catalog()` and `health()`: ```python def catalog(self) -> dict: """List all available data sources.""" resp = self.session.get(f"{self.base_url}/catalog") resp.raise_for_status() return resp.json() def health(self) -> dict: """Check API health status.""" resp = self.session.get(f"{self.base_url}/health") resp.raise_for_status() return resp.json() ``` ### Technical Analysis The client stores `X-API-Key` as a default session header while allowing the request origin to be selected through either the `base_url` constructor parameter or the `FINDDATA_BASE_URL` environment variable. It performs no scheme enforcement, hostname allowlisting, or explicit authorization check before forwarding the credential. Consequently, anyone who can influence client construction or the process environment can cause the API key to be transmitted to an arbitrary HTTP or HTTPS server. Allowing plaintext HTTP also permits interception by a network-positioned attacker. Because the header is configured on the shared session, the issue aff ...[truncated 1339 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict authenticated requests to an explicit HTTPS origin allowlist, such as `https://finddata.ai`. 2. Parse the URL and reject non-HTTPS schemes, embedded user information, malformed hosts, and unexpected ports. 3. Do not attach credentials as global session headers when requests may target configurable origins. Add `X-API-Key` only after validating each request URL. 4. If custom endpoints are required, make them an explicit opt-in and require separate credentials rather than reusing the production API key. 5. Disable cross-origin redirects for authenticated requests or validate every redirect target before forwarding authentication headers. 6. Treat `FINDDATA_BASE_URL` as security-sensitive configuration and prevent untrusted users from controlling the process environment. 7. Add tests confirming that credentials are never sent to plaintext, unapproved, or redirected origins.