T09 · Insecure Skill Coding Practices
Error
- Location
cdf/ai/skillPrint.py:82- Finding
Bearer Token Forwarded to an Unvalidated Cloud-Provided URL
- Content
View full analysis
bytes: """Download binary print data returned by the cloud service.""" if not url.strip(): raise RuntimeError("Download failed: fileUrl is empty.") req = request.Request( url.strip(), headers=build_common_headers(), method="GET", ) try: with request.urlopen(req, timeout=timeout) as resp: return resp.read() except error.HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace") raise RuntimeError(f"Download returned HTTP {exc.code}: {detail}") from exc except error.URLError as exc: raise RuntimeError(f"Download failed: {exc}") from exc ``` The downloaded URL is obtained directly from the cloud response: ```python file_url = _extract_string(response, "fileUrl") response["fileUrl"] = file_url or response.get("fileUrl") response["cloudSuccess"] = bool(response.get("success")) if not response["cloudSuccess"]: return response if not file_url: response["success"] = False response["reason"] = response["reason"] or "_pfs succeeded but did not return fileUrl." return response data = _download_binary(file_url, timeout=DEFAULT_TIMEOUT) bytes_sent = _send_to_printer(port_addr, raw_port, data) ``` The common headers include the configured bearer token: ```python def read_api_key() -> str: """Read the optional Bearer token.""" return os.environ.get(API_KEY_ENV, "").strip() def build_common_headers(content_type: str | None = None) -> dict[str, str]: """Build common request headers.""" headers = { "Accept": "application/json", "tid": SKILL_TERMINAL_ID, "ttp": SKI ...[truncated 2960 chars]- Remediation
View remediation