T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/lib/providers.mjs:290
- Finding
- Ark API Credentials and Private Image Data Can Be Sent to an Arbitrary Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/providers.mjs`, lines 290-301 **Vulnerability Type**: Unvalidated provider endpoint override resulting in sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```js describe(req) { return `POST ${env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3'}/images/generations model=${ark.model() || '<需设 ARK_MODEL>'}` }, async run(req) { if (!ark.model()) throw new Error('火山方舟需指定模型：export ARK_MODEL=<你开通的 seedream 模型 ID>') const base = env.ARK_BASE_URL || 'https://ark.cn-beijing.volces.com/api/v3' const body = { model: ark.model(), prompt: req.prompt, size: req.size || '2K', response_format: 'url', watermark: false, } if (req.images?.length) body.image = await Promise.all(req.images.map(asDataUri)) const j = await postJson(`${base}/images/generations`, body, { authorization: `Bearer ${env.ARK_API_KEY}` }, req.timeoutMs) ``` ### Technical Analysis The Ark provider accepts `ARK_BASE_URL` directly from the process environment and uses it as the destination for an authenticated HTTP request. The value is not restricted to the official Ark hostname and is not required to use HTTPS. The resulting request contains: - The reusable `ARK_API_KEY` bearer credential in the `Authorization` header. - The user's generation prompt. - Generation parameters. - Local reference images encoded as data URIs when images are supplied. Consequently, any party capable of influencing the process environment can redirect the complete authenticated request to an attacker-controlled endpoint. Allowing an `http://` endpoint also permits plaintext transmission and network interception. Cloud transmission itself is necessary for the declared image-generation functionality and is disclosed in the provider documentation. However, sending credentials and private assets to an unrestricted endpoint exceeds the minimum privilege needed to communicate with the legitimate Ark service. ## ...[truncated 1357 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `ARK_BASE_URL` overriding if custom Ark-compatible endpoints are not an explicit requirement. 2. If endpoint overriding is required, parse the value with `new URL()` and enforce: - The `https:` protocol. - An exact allowlist of trusted hostnames. - Approved ports only. - No embedded username or password. - An expected pathname prefix. 3. Do not send `ARK_API_KEY` to a non-official origin. Use separate, endpoint-specific credentials for explicitly supported custom providers. 4. Disable automatic redirects for authenticated requests, or validate every redirect destination before forwarding authorization headers. 5. Require explicit provider selection and informed confirmation before transmitting reference images to a custom endpoint. 6. Document the destination hostname in dry-run output and clearly warn when any non-default endpoint is configured. 7. Add automated tests confirming that HTTP URLs, unapproved domains, embedded credentials, unexpected ports, and cross-origin redirects are rejected. ]]>