T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate_image.py:109
- Finding
- DashScope API Key Can Be Exfiltrated Through an Unrestricted Endpoint Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:109-119` and `scripts/generate_image.py:148-150` **Vulnerability Type**: Arbitrary credential destination / sensitive information disclosure **Risk Level**: High ### Vulnerable Code ```python def _post_json(url: str, api_key: str, payload: dict[str, Any]) -> dict[str, Any]: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }, method="POST", ) with urllib.request.urlopen(req) as response: body = response.read().decode("utf-8") return json.loads(body) ``` ```python def call_generate(req: dict[str, Any]) -> dict[str, Any]: api_key = os.getenv("DASHSCOPE_API_KEY") if not api_key: raise RuntimeError("DASHSCOPE_API_KEY is not set") base_url = req.get("base_url") or os.getenv("DASHSCOPE_BASE_URL") or DEFAULT_BASE_URL payload = _build_payload(req) resp = _post_json(base_url, api_key, payload) ``` ### Technical Analysis The script loads a DashScope API key from the environment, `.env` files, or `~/.alibabacloud/credentials`. Access to this credential is necessary for the declared image-generation operation. However, the destination receiving that credential can be supplied directly through the request object's `base_url` field or indirectly through the `DASHSCOPE_BASE_URL` environment variable. The script does not validate: - The URL scheme - The destination hostname - The destination port - The API path - Embedded URL user information - Whether redirects remain on an approved origin The `_post_json` function unconditionally attaches the loaded credential as a bearer token to the selected URL. Therefore, a crafted request can cause the user's secret API key and image prompt to be transmitted to an attacker-controlled serve ...[truncated 2076 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove request-level arbitrary endpoint overrides unless they are strictly required. 2. Allowlist the exact documented HTTPS endpoints: - `https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation` - `https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation` 3. Parse URLs with `urllib.parse.urlsplit` and require: - Scheme equal to `https` - An exact approved hostname - No username or password component - No unexpected port - The exact approved API path 4. Disable automatic redirects for authenticated requests, or validate every redirect target and refuse cross-origin redirects before resending the `Authorization` header. 5. Do not derive a credential-bearing endpoint from untrusted request JSON. 6. If custom enterprise endpoints are necessary, require explicit administrator configuration and a separate allowlist rather than accepting arbitrary caller input. 7. Add tests confirming that HTTP URLs, unknown hosts, userinfo URLs, alternate ports, malformed URLs, and cross-origin redirects are rejected. 8. Rotate any API key that may already have been used with an untrusted `base_url`. ]]>