T09 · Insecure Skill Coding Practices
Error
- Location
tuqu-photo-api/scripts/tuqu_request.py:118- Finding
Service credentials can be transmitted to arbitrary attacker-controlled hosts
- Content
View full analysis
str: parsed = urllib.parse.urlparse(path) if parsed.scheme and parsed.netloc: return parsed.path or "/" return path.split("?", 1)[0] def match_endpoint_rule(path: str) -> tuple[str, str, str, str]: lookup_path = normalize_path(path) for rule in ENDPOINT_RULES: prefix = rule[0] if lookup_path == prefix or lookup_path.startswith(prefix + "/"): return rule raise ValueError( "This path is not covered by the helper. Pass --base-url and --auth-mode explicitly." ) ``` ```python def build_url(base_url: str, path: str, query_items: list[tuple[str, str]]) -> str: if path.startswith("http://") or path.startswith("https://"): base = path else: base = urllib.parse.urljoin(base_url.rstrip("/") + "/", path.lstrip("/")) if not query_items: return base separator = "&" if urllib.parse.urlparse(base).query else "?" return base + separator + urllib.parse.urlencode(query_items) ``` ```python auth_mode = args.auth_mode if auth_mode == "auto": auth_mode = detect_auth_mode(args.path) body = prepare_body(auth_mode, body, args.service_key) base_url = args.base_url or detect_base_url(args.path) headers = { "Accept": "application/json", } if auth_mode == "api-key": if not args.service_key: raise ValueError("Missing service key. Pass --service-key for this endpoint.") headers["x-api-key"] = args.service_key if auth_mode == "service-key": service_key = resolve_service_key(args.service_key, body, query_items) if not service_key: raise ValueError( "Missing service key. Pass --service-key, pass --query " "servic ...[truncated 2558 chars]- Remediation
View remediation