T09 · Insecure Skill Coding Practices
Error
- Location
scripts/test_nano_banana_2.py:277- Finding
Unrestricted API Endpoint Allows Bearer Credential Exfiltration
- Content
View full analysis
dict[str, str]: return {"Authorization": f"Bearer {api_key}"} ``` ```python parser.add_argument("--base-url", default="https://ai.t8star.cn") ``` ```python with httpx.Client(headers=_build_headers(api_key), follow_redirects=True) as client: try: size = args.size.strip() or None if mode in {"text", "both"}: print("[文生图] 测试中...") run_text_to_image( client, args.base_url.rstrip("/"), ``` The same client is used by `run_text_to_image()` and `run_image_to_image()`: ```python resp = client.post(f"{base_url}/v1/images/generations", json=payload, timeout=300) ``` ```python resp = client.post( f"{base_url}/v1/images/edits", data=form_data, files=files, timeout=300, ) ``` ### Technical Analysis The script accepts an unrestricted `--base-url` argument and creates an HTTP client with the API key installed as a client-wide `Authorization` header. Consequently, the bearer credential is sent to whichever origin is supplied through that argument. This conflicts with `SKILL.md:71`, which states that the API base address must remain fixed at `https://ai.t8star.cn`. The restriction exists only as a natural-language instruction and is not enforced in executable code. Allowing redirects with `follow_redirects=True` also enlarges the network trust boundary. Although HTTP clients may remove sensitive headers on some cross-origin redirects, security must not depend on undocumented or version-specific redirect behavior. Redirect destinations and downloadable image URLs should be explicitly constrained. ### Attack Path 1. An attacker causes the script to be invoked with an attacker-controlled base URL, for e ...[truncated 1271 chars]- Remediation
View remediation