T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pt_runtime.py:219- Finding
Unrestricted Configurable Endpoints Permit SSRF and Credential Disclosure
- Content
View full analysis
tuple[int, str, bytes, dict[str, str]]: import urllib.error import urllib.request req = urllib.request.Request(url, method=method.upper(), data=data) req.add_header("User-Agent", USER_AGENT) for key, value in (headers or {}).items(): req.add_header(key, value) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.status, resp.geturl(), resp.read(), dict(resp.headers.items()) except urllib.error.HTTPError as exc: body = exc.read() return exc.code, exc.geturl(), body, dict(exc.headers.items()) except urllib.error.URLError as exc: raise RuntimeErrorJson("network_error", str(exc.reason)) from exc except TimeoutError as exc: raise RuntimeErrorJson("network_timeout", "The remote service did not respond before the timeout.") from exc ``` Tracker credentials are resolved from environment references and placed directly in request headers: ```python def tracker_headers(tracker: dict[str, Any]) -> dict[str, str]: headers: dict[str, str] = {} secret_refs = tracker.get("secretRefs") if isinstance(tracker.get("secretRefs"), dict) else {} cookie_ref = get_secret_ref(secret_refs, "cookie") or tracker.get("cookieRef") if tracker.get("authMode") == "cookie" or cookie_ref: cookie = resolve_r ...[truncated 7711 chars]- Remediation
View remediation