T09 · Insecure Skill Coding Practices
Error
- Location
scripts/realtime_tts_demo.py:93- Finding
DashScope API Key Disclosure Through a Caller-Controlled Endpoint
- Content
View full analysis
dict[str, Any]: dashscope.base_http_api_url = base_url try: stream = dashscope.MultiModalConversation.call( model=REALTIME_MODEL, api_key=os.getenv("DASHSCOPE_API_KEY"), text=text, voice=voice, instruction=instruction, language_type=language_type, stream=True, ) ``` The fallback operation has the same behavior: ```python def _fallback_generate(text: str, voice: str, instruction: str | None, language_type: str, base_url: str, output: Path) -> dict[str, Any]: dashscope.base_http_api_url = base_url response = dashscope.MultiModalConversation.call( model=FALLBACK_MODEL, api_key=os.getenv("DASHSCOPE_API_KEY"), text=text, voice=voice, instruction=instruction, language_type=language_type, stream=False, ) ``` The destination is exposed as an unrestricted command-line argument: ```python parser.add_argument("--base-url", default="https://dashscope.aliyuncs.com/api/v1") ``` ### Technical Analysis The script reads a DashScope API key from the process environment, local `.env` files, or `~/.alibabacloud/credentials`. It then explicitly supplies that credential to the DashScope SDK. At the same time, the SDK's global API endpoint is assigned from the caller-controlled `--base-url` argument without validating its scheme, hostname, port, or trust relationship. Consequently, a caller who can influence invocation arguments can redirect authenticated requests away from the intended Alibaba Cloud service. Although sending the API key and synth ...[truncated 2062 chars]- Remediation
View remediation