T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/media_auditor.py:49
- Finding
- Bearer credentials can be redirected to attacker-controlled endpoints<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/_common.py:74-99` - `scripts/media_auditor.py:49-72` - `scripts/agnes_image.py:53-61` - `scripts/agnes_video.py:98-138` - `scripts/kolors_image.py:40-54` - `scripts/sensenova_image.py:43-56` **Vulnerability Type**: Improper URL and hostname validation leading to credential disclosure **Risk Level**: High ### Vulnerable Code The API-key resolver identifies providers using substring matching: ```python def resolve_api_key(ref, provider=None): """Resolve an API key from a config reference or provider name.""" models = load_models_json().get("models", []) if isinstance(load_models_json(), dict) else load_models_json() if isinstance(models, dict): models = models.get("models", []) if ref and ref.startswith("models.json:"): target_id = ref.split(":", 1)[1] for e in models: if e.get("id") == target_id: return e.get("apiKey") host = PROVIDER_HOSTS.get(provider) if host: for e in models: url = e.get("url", "") if host in url: return e.get("apiKey") if ref in PROVIDER_HOSTS: host = PROVIDER_HOSTS[ref] for e in models: if host in e.get("url", ""): return e.get("apiKey") raise KeyError("Unable to resolve API key: ref=%s, provider=%s" % (ref, provider)) ``` The auditor applies the same substring test and derives the credential-bearing request base from the matched URL: ```python def base_for(provider, models): host = C.PROVIDER_HOSTS.get(provider) if not host: return None for e in models: if host in e.get("url", ""): u = e["url"].rstrip("/") for suffix in ("/chat/completions", "/completions", "/v1beta/openai", "/v1beta", "/v4"): if u.endswith(suffix): u = u[: -len(suffix)] break retu ...[truncated 3539 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse every URL with `urllib.parse.urlsplit()` before using it. 2. Require: - `scheme == "https"` - Exact, case-normalized hostname equality with the selected provider. - No embedded username or password. - No fragments. - Only explicitly approved ports. 3. Replace substring checks with exact provider-origin validation: ```python from urllib.parse import urlsplit APPROVED_HOSTS = { "agnes": {"api.agnes-ai.cn"}, "sensenova": {"token.sensenova.cn"}, "siliconflow": {"api.siliconflow.cn"}, } def validate_provider_url(provider, url): parsed = urlsplit(url) allowed = APPROVED_HOSTS.get(provider, set()) if parsed.scheme.lower() != "https": raise ValueError("Only HTTPS endpoints are allowed") if parsed.username is not None or parsed.password is not None: raise ValueError("Credentials in endpoint URLs are prohibited") if (parsed.hostname or "").lower() not in allowed: raise ValueError("Endpoint hostname is not approved for this provider") if parsed.port not in (None, 443): raise ValueError("Endpoint port is not approved") return parsed ``` 4. Do not infer credential-bearing catalog endpoints from arbitrary `models.json` URLs. Store immutable provider API origins in code and append only known paths. 5. Validate each `config.json` endpoint against the model’s declared provider before resolving or attaching its API key. 6. Disable automatic cross-origin redirects for credential-bearing requests, or revalidate every redirect target and strip authorization headers whenever the origin changes. 7. Use a structured provider-to-key mapping instead of selecting keys based on model URL substrings. 8. Restrict write permissions on `config.json` and `models.json`, and treat configuration changes as security-sensitive. 9. Add regression tests for malicious values such as: - `https://api.agnes-ai.cn.attacker.example/` - `https://attacker.example/api.ag ...[truncated 157 chars]