T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_literature_workflow.py:78- Finding
Unrestricted API Endpoint Can Expose Credentials and Research Data Over Insecure Transport
- Content
View full analysis
str: base = base_url.rstrip("/") if base.endswith("/v1"): return base + "/chat/completions" return base + "/v1/chat/completions" def call_chat( config: dict[str, str], messages: list[dict[str, str]], max_tokens: int, temperature: float = 0.2, retries: int = 5, timeout: int = 180, ) -> str: payload = { "model": config["model"], "messages": messages, "temperature": temperature, "max_tokens": max_tokens, } data = json.dumps(payload).encode("utf-8") url = chat_url(config["base_url"]) headers = { "Authorization": f"Bearer {config['api_key']}", "Content-Type": "application/json", } for attempt in range(retries): try: request = urllib.request.Request(url, data=data, headers=headers, method="POST") with urllib.request.urlopen(request, timeout=timeout) as response: body = json.loads(response.read().decode("utf-8")) return body["choices"][0]["message"]["content"] except ( urllib.error.HTTPError, urllib.error.URLError, TimeoutError, socket.timeout, ConnectionResetError, OSError, http.client.HTTPException, KeyError, json.JSONDecodeError, ) as exc: if attempt == retries - 1: raise RuntimeError(f"LLM call failed after {retries} attempts: {exc}") from exc time.sleep(min(30, 2 ** attempt) + random.random()) raise RuntimeError("unreachable") ``` ### Technical Analysis The configured `base_url` is used without validating its scheme, destination, or trust level. The co ...[truncated 2177 chars]- Remediation
View remediation