T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/video_api.py:29- Finding
Unrestricted API Base URL Override Can Disclose Credentials and Video Prompts
- Content
View full analysis
None: self.base_url = os.environ.get("SENSEAUDIO_BASE_URL", DEFAULT_BASE_URL).rstrip("/") self.api_key = os.environ.get("SENSEAUDIO_API_KEY", "").strip() self.model = DEFAULT_MODEL if not self.api_key: raise RuntimeError("Missing configuration: SENSEAUDIO_API_KEY") def _headers(self) -> Dict[str, str]: return { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", } def create_video(self, request: VideoRequest) -> str: prompt = (request.final_video_prompt or "").strip() if not prompt: raise RuntimeError("final_video_prompt must not be empty") payload = { "model": self.model, "content": [{"type": "text", "text": prompt}], "duration": DEFAULT_DURATION, "resolution": DEFAULT_RESOLUTION, "ratio": request.ratio, "provider_specific": {"generate_audio": True}, } resp = requests.post( f"{self.base_url}/v1/video/create", headers=self._headers(), json=payload, timeout=60, ) ``` The same unrestricted base URL is also used for status requests: ```python resp = requests.get( f"{self.base_url}/v1/video/status", headers=self._headers(), params={"id": clean_task_id}, timeout=30, ) ``` ### Technical Analysis The `SENSEAUDIO_BASE_URL` environment variable is accepted without validating its scheme, hostname, port, or destination. The client subsequently sends the `SENSEAUDIO_API_KEY` as a bearer token to that endpoint. Video-creation requests also transmit the complete finalized video prompt. Con ...[truncated 2053 chars]- Remediation
View remediation