T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate_image.py:145
- Finding
- DashScope API Key Disclosure Through an Unrestricted Endpoint Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_image.py:112-121, 145-147` **Vulnerability Type**: Arbitrary credential-bearing network request **Risk Level**: High ### Vulnerable Code ```python def _post_json(url: str, api_key: str, payload: dict[str, Any]) -> dict[str, Any]: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }, method="POST", ) with urllib.request.urlopen(req) as response: body = response.read().decode("utf-8") return json.loads(body) ``` ```python base_url = req.get("base_url") or os.getenv("DASHSCOPE_BASE_URL") or DEFAULT_BASE_URL payload = _build_payload(req) resp = _post_json(base_url, api_key, payload) ``` ### Technical Analysis The request-controlled `base_url` is passed directly to `_post_json` without validating its scheme, hostname, port, path, or destination. `_post_json` attaches the user's DashScope API key as a bearer credential to every request. Although regional endpoint selection is necessary for the declared image-generation functionality, sending a DashScope credential to an arbitrary caller-selected origin is not necessary. The documented legitimate endpoints are limited to the Beijing and Singapore DashScope hosts. The implementation also permits a cleartext `http://` URL, which could expose the bearer credential and prompt to network observers. Redirect behavior is not constrained by an explicit same-origin policy, adding further uncertainty around where sensitive request data may be sent. ### Attack Path 1. The victim has a valid `DASHSCOPE_API_KEY` in the environment, a loaded `.env` file, or `~/.alibabacloud/credentials`. 2. An attacker persuades the victim or an invoking agent to process a request containing an attacker-controlled endpoint, for example: ...[truncated 978 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary `base_url` support unless it is operationally required. 2. Allowlist the exact supported HTTPS endpoints: - `https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation` - `https://dashscope-intl.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation` 3. Parse URLs with `urllib.parse.urlsplit` and require: - The `https` scheme. - An exact approved hostname. - The expected API path. - No embedded username or password. - No unexpected port. 4. Disable redirects or validate every redirect target and reject cross-origin redirects. 5. If custom endpoints must remain supported, do not automatically attach the DashScope key. Require a separately supplied credential explicitly intended for that endpoint. 6. Avoid including credentials, authorization headers, or complete request URLs in logs and exception output. 7. Add tests proving that HTTP, loopback, private-network, malformed, and non-DashScope endpoints are rejected before any network request occurs. ]]>