T09 · Insecure Skill Coding Practices
Error
- Location
scripts/model_gateway.py:91- Finding
Cross-user disclosure through an unscoped semantic response cache
- Content
View full analysis
Optional[str]: """Simple similarity matching (use a vector DB in production)""" query_lower = query.lower().strip() for key, (cached_query, response) in self.store.items(): if query_lower in cached_query.lower() or cached_query.lower() in query_lower: return response # Simple Jaccard similarity q_words = set(query_lower.split()) c_words = set(cached_query.lower().split()) if q_words and c_words: sim = len(q_words & c_words) / len(q_words | c_words) if sim >= self.threshold: return response return None def set(self, query: str, response: str): key = hashlib.md5(query.encode()).hexdigest() self.store[key] = (query, response) ``` ```python # 1. Cache lookup if cached := self.cache.get(query): self.stats["cache_hits"] += 1 return RouteResult( endpoint=ModelEndpoint("cache", "cache", "local", 0, 0), response=cached, latency_ms=5, input_tokens=0, output_tokens=0, cost_usd=0, cache_hit=True, ) # 2. Determine complexity if complexity is None: complexity = self._estimate_complexity(query) # 3. Select endpoint endpoint = self._select_endpoint(complexity) fallback_used = False # 4. Call LLM try: result = self._call_llm(endpoint, query) self.circuit_breakers[endpoint.name] = max( 0, self.circuit_breakers[endpoint.name] - 1 ) self.cache.set(query, result.response) except Exception: self.circuit_breakers[endpoint.name] += 1 self.stats["fallbacks"] += 1 fallback_used = True fallback = self._select_fallback(complexity, exclude=endpoint.name) result = self._call_llm(fallback, q ...[truncated 1833 chars]- Remediation
View remediation