T09 · Insecure Skill Coding Practices
Error
- Location
scripts/common/task_client.py:21- Finding
Arbitrary endpoint override can disclose bearer credentials and user media
- Content
View full analysis
list[str]: images = [] if not value: return images for image in value.split(","): image = image.strip() if not image: continue if os.path.exists(image): # Security Note: Reading local file for base64 encoding try: with open(image, "rb") as f: image_bytes = f.read() image_base64 = base64.b64encode(image_bytes).decode("utf-8") images.append(image_base64) except Exception as e: raise ValueError(f"Failed to read image file '{image}': {e}") else: # Assume it's a URL or base64 string images.append(image) return images ``` ```python def submit_task_and_poll_result( payload: dict[str, Any], path: str, authorization, poll_timeout: int ) -> dict[str, Any]: authorization = authorization or get_token() if not authorization: raise ValueError( "Missing authorization. Run 'scripts/configure.py' or set HIDREAM_AUTHORIZATION." ) endpoint = f"{ENDPOINT}{path}" headers = _headers(authorization) # print(payload) submit_resp = requests.post(endpoint, json=payload, headers=headers, timeout=30) ``` ```python result_url = endpoint + "/results" start = time.time() while True: query_resp = requests.get( result_url, params={"task_id": task_id}, headers=headers, timeo ...[truncated 2590 chars]- Remediation
View remediation