T09 · Insecure Skill Coding Practices
Error
- Location
assets/horse-blessing-template/app/api/generate/route.ts:34- Finding
Unauthenticated Public Endpoints Can Consume Billable AI Resources
- Content
View full analysis
10) { return NextResponse.json({ error: '请输入有效的名字（1-10个字）' }, { status: 400 }) } const trimmed = name.trim() const chars = Array.from(trimmed) const padded = chars.length >= 4 ? chars.slice(0, 4) : [...chars, ...['马', '到', '成', '功'].slice(0, 4 - chars.length)] // Prompt construction omitted here only for readability. const textRaw = await geminiGenerate(textPrompt) const jsonMatch = textRaw.match(/\{[\s\S]*\}/) if (!jsonMatch) throw new Error('文本生成格式错误') const textResult = JSON.parse(jsonMatch[0]) const imageBase64 = await imagenGenerate(imagePrompt) return NextResponse.json({ poem: textResult.poem, blessing: textResult.blessing, fortune: textResult.fortune || '马到成功', image: imageBase64 ? `data:image/png;base64,${imageBase64}` : null, }) } catch (e: any) { console.error('Generate error:', e) return NextResponse.json({ error: '生成失败，请重试: ' + e.message }, { status: 500 }) } } ``` `assets/horse-blessing-template/app/api/sticker/route.ts`: ```ts export async function POST(req: NextRequest) { try { const { text, styleId } = await req.json() if (!text || typeof text !== 'string' || text.trim().length === 0 || text.trim().length > 8) { return NextResponse.json({ error: '请输入1-8个字的表情文字' }, { status: 400 }) } const trimmed = text.trim() const styleDesc = STYLE_PROMPTS[styleId] || ST ...[truncated 2318 chars]- Remediation
View remediation