T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/m5stack_firmware_query.py:107- Finding
Unrestricted API Base URL Enables Server-Side Request Forgery and Insecure HTTP Communication
- Content
View full analysis
None: base_url = base_url.strip().rstrip("/") if not base_url.startswith(("http://", "https://")): raise ApiError("base URL must start with http:// or https://") self.base_url = base_url self.timeout = timeout def get( self, path: str, *, params: Mapping[str, Any] | None = None, headers: Mapping[str, str] | None = None, ) -> Any: query = urlencode(compact_params(params or {})) url = f"{self.base_url}/{path.lstrip('/')}" if query: url = f"{url}?{query}" request_headers = { "Accept": "application/json", "User-Agent": USER_AGENT, } request_headers.update(headers or {}) request = Request(url, headers=request_headers, method="GET") try: with urlopen(request, timeout=self.timeout) as response: raw = response.read() status = response.status ``` ```python parser.add_argument( "--base-url", default=DEFAULT_BASE_URL, help="Compatible M5Burner base URL (or M5BURNER_API_BASE_URL)", ) ``` ### Technical Analysis The API client validates only that the supplied base URL begins with `http://` or `https://`. It does not restrict the destination hostname, port, resolved IP address, or transport security. Consequently, either the `--base-url` argument or the `M5BURNER_API_BASE_URL` ...[truncated 3093 chars]- Remediation
View remediation