T09 · Insecure Skill Coding Practices
Error
- Location
scripts/content_engine/llm.py:53- Finding
OpenRouter API Key Is Transmitted to the Ofox API Endpoint
- Content
View full analysis
str | None: """env > .env 文件三源。允许 OPENROUTER_API_KEY 作为兼容备选。""" for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if v := os.environ.get(var): return v.strip() for path_fn in _TOKEN_SEARCH_PATHS: try: path = path_fn() except Exception: continue if not path.exists() or not path.is_file(): continue try: for line in path.read_text(encoding="utf-8").splitlines(): line = line.strip() for var in ("OFOX_API_KEY", "OPENROUTER_API_KEY"): if line.startswith(f"{var}="): val = line.split("=", 1)[1].strip() return val.strip('"').strip("'") except (OSError, UnicodeDecodeError): continue return None ``` The selected credential does not cause the endpoint to switch to the corresponding provider. Unless explicitly overridden, the client continues to use the Ofox endpoint: ```python self.base_url = (base_url or os.environ.get("OFOX_BASE_URL") or OFOX_BASE_URL).rstrip("/") self.model = model or os.environ.get("OFOX_LLM_MODEL") or DEFAULT_MODEL ``` The selected key is then transmitted as a bearer credential to that endpoint: ```python req = urllib.request.Request( url, data=body, headers={ "Content-Type": "application/json; charset=utf-8", "Authorization": f"Bearer {self.api_key}", }, method="POST", ) with urllib.request.urlopen(req, timeout=self.timeout) as resp: data = json.loads(resp.read()) ``` The mod ...[truncated 2786 chars]- Remediation
View remediation