T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-image.ts:12- Finding
Google API Credential Can Be Redirected to an Arbitrary Server
- Content
View full analysis
{ const res = await fetch(url, { method: "POST", headers: { "Content-Type": "application/json", "x-goog-api-key": API_KEY! }, body, }); if (!res.ok) throw new Error(`Google API error (${res.status}): ${await res.text()}`); return extractImage(await res.text()); } function generateViaCurl(): Uint8Array { const proxy = process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.https_proxy || process.env.http_proxy || null; const curlArgs = [ "-s", "--connect-timeout", "30", "--max-time", "300", ...(proxy ? ["-x", proxy] : []), url, "-H", "Content-Type: application/json", "-H", `x-goog-api-key: ${API_KEY}`, "-d", body, ]; const result = execFileSync("curl", curlArgs, { maxBuffer: 100 * 1024 * 1024, timeout: 310000 }); return extractImage(result.toString()); } async function generate(): Promise { const hasProxy = !!(process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.https_proxy || process.env.http_proxy); // Use curl when behind a proxy (Bun fetch has known proxy issues) if (hasProxy) return generateViaCurl(); return generateViaFetch(); } ``` ### Technical Analysis The image-generation script obtains a Google or Gemini API key from the process environment. However, the destination receiving that credential is also controlled thro ...[truncated 2504 chars]- Remediation
View remediation