T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_image.py:109- Finding
DashScope API Key Can Be Exfiltrated Through an Unrestricted Endpoint Override
- Content
View full analysis
dict[str, Any]: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }, method="POST", ) with urllib.request.urlopen(req) as response: body = response.read().decode("utf-8") return json.loads(body) ``` ```python def call_generate(req: dict[str, Any]) -> dict[str, Any]: api_key = os.getenv("DASHSCOPE_API_KEY") if not api_key: raise RuntimeError("DASHSCOPE_API_KEY is not set") base_url = req.get("base_url") or os.getenv("DASHSCOPE_BASE_URL") or DEFAULT_BASE_URL payload = _build_payload(req) resp = _post_json(base_url, api_key, payload) ``` ### Technical Analysis The script loads a DashScope API key from the environment, `.env` files, or `~/.alibabacloud/credentials`. Access to this credential is necessary for the declared image-generation operation. However, the destination receiving that credential can be supplied directly through the request object's `base_url` field or indirectly through the `DASHSCOPE_BASE_URL` environment variable. The script does not validate: - The URL scheme - The destination hostname - The destination port - The API path - Embedded URL user information - Whether redirects remain on an approved origin The `_post_json` function unconditionally attaches the loaded credential as a bearer token to the selected URL. Therefore, a crafted request can cause the user's secret API key and image prompt to be transmitted to an attacker-controlled serve ...[truncated 2076 chars]- Remediation
View remediation