T09 · Insecure Skill Coding Practices
Error
- Location
tuqu-photo-api/scripts/tuqu_request.py:192- Finding
Authenticated requests can exfiltrate credentials and private images to arbitrary hosts
- Content
View full analysis
str: _, _, env_name, default_base_url = match_endpoint_rule(path) return os.environ.get(env_name, default_base_url) ``` ```python def build_url(base_url: str, path: str, query_items: list[tuple[str, str]]) -> str: if path.startswith("http://") or path.startswith("https://"): base = path else: base = urllib.parse.urljoin(base_url.rstrip("/") + "/", path.lstrip("/")) if not query_items: return base separator = "&" if urllib.parse.urlparse(base).query else "?" return base + separator + urllib.parse.urlencode(query_items) ``` ```python body = prepare_body(auth_mode, body, args.service_key) base_url = args.base_url or detect_base_url(args.path) headers = { "Accept": "application/json", } if auth_mode == "api-key": if not args.service_key: raise ValueError("Missing service key. Pass --service-key for this endpoint.") headers["x-api-key"] = args.service_key if auth_mode == "service-key": service_key = resolve_service_key(args.service_key, body, query_items) if not service_key: raise ValueError( "Missing service key. Pass --service-key, pass --query " "serviceKey=..., or provide serviceKey in the JSON body." ) headers["Authorization"] = f"Bearer {service_key}" data = None if body is not None: headers["Content-Type"] = "application/json" data = json.dumps(body).encode("utf-8") url = build_url(base_url, args.path, query_items) ``` ### Technical An ...[truncated 2458 chars]- Remediation
View remediation