T09 · Insecure Skill Coding Practices
Error
- Location
scripts/serve.py:301- Finding
Unauthenticated and Unbounded Transcription Endpoint Enables Resource Exhaustion
- Content
View full analysis
tuple[np.ndarray, int]: """Decode base64-encoded audio to float32 mono 16kHz numpy array. Supports WAV, FLAC, OGG, MP3 (via soundfile) and M4A (via ffmpeg). """ raw = base64.b64decode(audio_b64) if len(raw) == 0: raise ValueError("Empty audio data") ``` ```python @app.post("/transcribe", response_model=TranscribeResponse) async def transcribe(req: TranscribeRequest): """Transcribe audio of any length. The server automatically chunks long audio using VAD, infers each chunk via the batching engine, and merges the results into a single transcript. """ engine: BatchingEngine = _state["engine"] t0 = time.time() try: samples, sr = decode_audio_b64(req.audio_b64) except Exception as e: raise HTTPException(status_code=400, detail=f"Invalid audio: {e}") duration = len(samples) / sr # Chunk with VAD (short audio returns a single chunk) chunks = chunk_audio_samples(samples, sr) # Infer chunks in batches of MAX_BATCH_CHUNKS all_texts = [] for i in range(0, len(chunks), MAX_BATCH_CHUNKS): batch = chunks[i : i + MAX_BATCH_CHUNKS] tasks = [engine.submit(c.samples, c.sample_rate) for c in batch] texts = await asyncio.gather(*tasks) all_texts.extend(texts) ``` ```python parser.add_argument("--host", default="127.0.0.1", help="Bind host (default ...[truncated 2718 chars]- Remediation
View remediation