T09 · Insecure Skill Coding Practices
Error
- Location
2037.py:15- Finding
Credentials and bearer tokens can be transmitted to an untrusted or plaintext endpoint
- Content
View full analysis
EARTH2037_API_BASE > apiBase""" base_dir = os.path.dirname(os.path.abspath(__file__)) config_path = os.path.join(base_dir, "config.json") api_base = "https://2037en1.9235.net" if os.path.exists(config_path): try: with open(config_path, "r", encoding="utf-8") as f: cfg = json.load(f) api_base = cfg.get("apiBase", api_base) except (json.JSONDecodeError, IOError): pass if api_base_override: return api_base_override.rstrip("/") env_base = os.environ.get("EARTH2037_API_BASE", "").strip() if env_base: return env_base.rstrip("/") return api_base.rstrip("/") ``` ```python def cmd_login(api_base, username, password): url = f"{api_base}/auth/token" try: r = http_post(url, {"username": username, "password": password}) ``` ```python def _game_command(api_base, token, cmd, args=""): import urllib.request import urllib.error url = f"{api_base}/game/command" body = json.dumps({"cmd": cmd, "args": args or ""}).encode("utf-8") req = urllib.request.Request(url, data=body, method="POST") req.add_header("Content-Type", "application/json") req.add_header("Authorization", f"Bearer {token}") req.add_header("Accept", "application/json") try: resp = urllib.request.urlopen(req, timeout=30) ``` ### Technical Analysis The API base URL may be supplied through `config.json`, `EARTH2037_API_BASE`, or the `--api-base` command-line option. The value is used directly without validating its scheme, hostname, port, embedded credentials, or relationship t ...[truncated 2050 chars]- Remediation
View remediation