T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/realtime_tts_demo.py:93
- Finding
- DashScope API Key Disclosure Through a Caller-Controlled Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/realtime_tts_demo.py`, lines 93-99, 153-160, and 203 **Vulnerability Type**: Credential exposure through an unrestricted network destination **Risk Level**: High ### Vulnerable Code ```python def _probe_realtime(text: str, voice: str, instruction: str | None, language_type: str, base_url: str) -> dict[str, Any]: dashscope.base_http_api_url = base_url try: stream = dashscope.MultiModalConversation.call( model=REALTIME_MODEL, api_key=os.getenv("DASHSCOPE_API_KEY"), text=text, voice=voice, instruction=instruction, language_type=language_type, stream=True, ) ``` The fallback operation has the same behavior: ```python def _fallback_generate(text: str, voice: str, instruction: str | None, language_type: str, base_url: str, output: Path) -> dict[str, Any]: dashscope.base_http_api_url = base_url response = dashscope.MultiModalConversation.call( model=FALLBACK_MODEL, api_key=os.getenv("DASHSCOPE_API_KEY"), text=text, voice=voice, instruction=instruction, language_type=language_type, stream=False, ) ``` The destination is exposed as an unrestricted command-line argument: ```python parser.add_argument("--base-url", default="https://dashscope.aliyuncs.com/api/v1") ``` ### Technical Analysis The script reads a DashScope API key from the process environment, local `.env` files, or `~/.alibabacloud/credentials`. It then explicitly supplies that credential to the DashScope SDK. At the same time, the SDK's global API endpoint is assigned from the caller-controlled `--base-url` argument without validating its scheme, hostname, port, or trust relationship. Consequently, a caller who can influence invocation arguments can redirect authenticated requests away from the intended Alibaba Cloud service. Although sending the API key and synth ...[truncated 2062 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--base-url` option if endpoint customization is not required for normal operation. 2. If regional endpoint selection is necessary, map a small set of supported region names to hardcoded Alibaba Cloud HTTPS endpoints instead of accepting arbitrary URLs. 3. Validate any configurable endpoint before assigning it: - Require the `https` scheme. - Require an exact approved Alibaba Cloud hostname. - Reject user information embedded in URLs. - Reject unexpected ports, IP literals, fragments, and malformed hosts. - Avoid suffix-only hostname checks that can be bypassed with domains such as `aliyuncs.com.attacker.example`. 4. Prevent authenticated requests from following redirects to unapproved hosts. Revalidate the destination after every redirect where SDK configuration permits. 5. If custom endpoints are needed for local testing, require an explicit development-only switch and refuse to attach production credentials to untrusted destinations. 6. Use a narrowly scoped API key with usage limits, monitoring, and regular rotation. 7. Document that TTS input is transmitted to Alibaba Cloud and should not contain secrets unless that disclosure is intended. 8. Parse only the required `DASHSCOPE_API_KEY` entry from `.env` files instead of importing every variable into the process environment. ]]>