T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_image.py:145- Finding
DashScope API Key Disclosure Through an Unrestricted Endpoint Override
- Content
View full analysis
dict[str, Any]: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }, method="POST", ) with urllib.request.urlopen(req) as response: body = response.read().decode("utf-8") return json.loads(body) ``` ```python base_url = req.get("base_url") or os.getenv("DASHSCOPE_BASE_URL") or DEFAULT_BASE_URL payload = _build_payload(req) resp = _post_json(base_url, api_key, payload) ``` ### Technical Analysis The request-controlled `base_url` is passed directly to `_post_json` without validating its scheme, hostname, port, path, or destination. `_post_json` attaches the user's DashScope API key as a bearer credential to every request. Although regional endpoint selection is necessary for the declared image-generation functionality, sending a DashScope credential to an arbitrary caller-selected origin is not necessary. The documented legitimate endpoints are limited to the Beijing and Singapore DashScope hosts. The implementation also permits a cleartext `http://` URL, which could expose the bearer credential and prompt to network observers. Redirect behavior is not constrained by an explicit same-origin policy, adding further uncertainty around where sensitive request data may be sent. ### Attack Path 1. The victim has a valid `DASHSCOPE_API_KEY` in the environment, a loaded `.env` file, or `~/.alibabacloud/credentials`. 2. An attacker persuades the victim or an invoking agent to process a request containing an attacker-controlled endpoint, for example: ...[truncated 978 chars]- Remediation
View remediation