T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pdf_to_md.py:20- Finding
Unrestricted API Endpoint Allows Disclosure of PDF Content and WPS Session Credentials
- Content
View full analysis
str: sid = ( os.environ.get("TMP_LX_UUID") or os.environ.get("wps_sid") or os.environ.get("WPS_SID") ) if not sid: raise SystemExit("缺少认证凭证：未设置环境变量 TMP_LX_UUID / wps_sid / WPS_SID") return sid class _Session: _HDR = { "Origin": "https://365.kdocs.cn", "Referer": "https://365.kdocs.cn/", } def __init__(self, sid: str): self._http = requests.Session() self._http.cookies.set("wps_sid", sid) self._http.cookies.set("csrf", sid) self._http.headers.update(self._HDR) ``` ```python def export_and_localize( pdf_path: Path, out_md: Path, images_subdir: str = "images", sid: Optional[str] = None, ) -> Path: pdf_path = pdf_path.resolve() if not pdf_path.is_file(): raise FileNotFoundError(pdf_path) session = _Session(sid or _resolve_sid()) name = pdf_path.name content = pdf_path.read_bytes() resp = session.post_multipart( f"{_API_BASE}/v7/longtask/exporter/export_file_content", files={"form_file": (name, content, "application/pdf")}, data={"format": "markdown", "include_elements": "all", "filename": name}, ) ``` ### Technical Analysis The script reads the complete local PDF into memory and uploads it through a session containing the WPS session identifier. The identifier is assigned to both the `wps_sid` and `csrf` cookies. The request destination is derived from the `WPS_API_BASE` environment variable without scheme validation, hostname allowlisting, or enforcement of the expected WPS API ori ...[truncated 1723 chars]- Remediation
View remediation