T09 · Insecure Skill Coding Practices
Error
- Location
scripts/providers/bailian.py:72- Finding
Arbitrary Bailian API Base Can Disclose the API Key and Submitted Media
- Content
View full analysis
str: base = os.environ.get("DASHSCOPE_API_BASE", DEFAULT_API_BASE) return API_ENDPOINTS.get(base, base) @property def api_key(self) -> str: val = os.environ.get(self.env_var) if not val: raise ConfigError( f"{self.env_var} environment variable not set.\n" f"Set it with: export {self.env_var}='your-api-key'\n" f"Get a key at: https://bailian.console.aliyun.com/") return val def auth_headers(self) -> dict: return {"Authorization": f"Bearer {self.api_key}"} ``` The resulting endpoint and authorization header are used during submission: ```python def submit(self, body: dict, oss_used: bool = False) -> str: headers = { "Content-Type": "application/json", **self.auth_headers(), "X-DashScope-Async": "enable", } if oss_used: headers["X-DashScope-OssResourceResolve"] = "enable" data = safe_json( safe_request("POST", self.api_base + SUBMIT_PATH, headers=headers, json=body, label="Bailian submit"), label="Bailian submit") task_id = data.get("output", {}).get("task_id") if not task_id: raise APIError( f"Bailian submit failed: " f"{data.get('code')} {data.get('message')}") return task_id ``` ### Technical Analysis The documentation presents `DASHSCOPE_API_BASE` as a region selector with expected values such as `cn`, `sg`, and `us`. The implementation nevertheless accepts any unrecognized value as a complete API base URL: ```python return API_ENDPOINTS.get(base, base) ``` No scheme or hostname allowlist is enforced. The Bailian API key is subsequently ad ...[truncated 1738 chars]- Remediation
View remediation
str: region = os.environ.get("DASHSCOPE_API_BASE", "cn") try: return API_ENDPOINTS[region] except KeyError: raise ConfigError( "DASHSCOPE_API_BASE must be one of: " + ", ".join(sorted(API_ENDPOINTS)) ) ``` 2. Do not accept arbitrary URLs through the same variable used for region selection. 3. If custom enterprise endpoints are required, place them behind a separate, explicitly named configuration option. 4. For custom endpoints: - Require HTTPS. - Validate the normalized hostname against an administrator-controlled allowlist. - Reject embedded credentials, fragments, nonstandard schemes, and ambiguous URL forms. - Prevent redirects from forwarding authorization headers to other hosts. 5. Add tests confirming that attacker-controlled hosts, HTTP endpoints, malformed URLs, and hostname-confusion inputs are rejected. 6. Document that prompts and selected images are transmitted to the configured provider and should not contain unrelated secrets. ]]>