T09 · Insecure Skill Coding Practices
Error
- Location
scripts/voiceclone.py:49- Finding
Sensitive voice-training data and authentication material transmitted over plaintext HTTP
- Content
View full analysis
str: """Get auth token from iFlytek auth service.""" ts = int(time.time() * 1000) body = { "base": { "appid": self.app_id, "version": "v1", "timestamp": str(ts), }, "model": "remote", } body_json = json.dumps(body) key_sign = hashlib.md5((self.api_key + str(ts)).encode("utf-8")).hexdigest() sign = hashlib.md5((key_sign + body_json).encode("utf-8")).hexdigest() req = urllib.request.Request( AUTH_TOKEN_URL, data=body_json.encode("utf-8"), headers={ "Authorization": sign, "Content-Type": "application/json", }, ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) ``` Subsequent training operations transmit the access token and application identifier over plaintext HTTP: ```python def _headers(self, sign: str) -> dict: return { "X-Sign": sign, "X-Token": self.token, "X-AppId": self.app_id, "X-Time": str(self._ts), "Content-Type": "application/json", } def _post(self, path: str, body: dict) -> dict: """POST JSON to training API.""" self._ensure_token() sign = self._sign_body(body) headers = self._headers(sign) data = json.dumps(body).encode("utf-8") req = urllib.request.Request( ...[truncated 3919 chars]- Remediation
View remediation