T09 · Insecure Skill Coding Practices
Error
- Location
scripts/quote_client.py:37- Finding
Bearer Token Transmission to an Unrestricted API Destination
- Content
View full analysis
Dict[str, str]: return { 'Authorization': f'Bearer {self.token}', 'Accept': 'application/json', } def get(self, path: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]: url = urljoin(self.base_url, path.lstrip('/')) resp = requests.get(url, headers=self._headers(), params=params or {}, timeout=self.timeout) return self._normalize_response(resp) def post(self, path: str, payload: Optional[Dict[str, Any]] = None) -> Dict[str, Any]: url = urljoin(self.base_url, path.lstrip('/')) resp = requests.post(url, headers={**self._headers(), 'Content-Type': 'application/json'}, json=payload or {}, timeout=self.timeout) return self._normalize_response(resp) ``` ### Technical Analysis The API destination is accepted from the `NOAH_API_BASE_URL` environment variable or the constructor without validating its scheme, hostname, port, or trust relationship. The client then unconditionally attaches the bearer credential to every GET and POST request. The documented producti ...[truncated 1677 chars]- Remediation
View remediation