T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rootly_morning_brief.py:342- Finding
Bearer credential disclosure to unrestricted network origins
- Content
View full analysis
str: value = os.getenv(name, "").strip() if value: return value file_var_name = f"{name}_FILE" file_var_value = os.getenv(file_var_name, "").strip() if file_var_value: file_path = Path(file_var_value).expanduser() try: file_value = file_path.read_text(encoding="utf-8").strip() except OSError as exc: raise ConfigError( f"{name} is missing and {file_var_name} could not be read: {file_path} ({exc})" ) from exc if file_value: return file_value raise ConfigError( f"{name} is missing and {file_var_name} points to an empty file: {file_path}" ) ``` That value is unconditionally converted into a Bearer credential: ```python def _build_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/vnd.api+json", "Content-Type": "application/vnd.api+json", "User-Agent": "rootly-morning-brief/1.0", } ``` Absolute HTTP and HTTPS destinations are accepted without scheme, hostname, or origin ...[truncated 6540 chars]- Remediation
View remediation