T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:108
- Finding
- Configurable API Endpoint Can Exfiltrate the API Key and User Text<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py`, lines 108-130 **Vulnerability Type**: Unrestricted destination for sensitive network requests **Risk Level**: High ### Vulnerable Code ```python class SenseAudioClient: def __init__(self, api_key: Optional[str] = None, api_base: Optional[str] = None): self.api_key = (api_key or os.getenv("SENSEAUDIO_API_KEY", "")).strip() self.api_base = (api_base or os.getenv("SENSEAUDIO_API_BASE", DEFAULT_API_BASE)).rstrip("/") self.api_url = f"{self.api_base}{DEFAULT_API_PATH}" @property def configured(self) -> bool: return bool(self.api_key) @property def headers(self) -> Dict[str, str]: if not self.api_key: raise APIError(_missing_key_message()) return { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", } def _post(self, payload: Dict[str, Any], stream: bool = False, timeout: int = 120) -> requests.Response: try: response = requests.post( self.api_url, headers=self.headers, json=payload, stream=stream, timeout=timeout, ) ``` ### Technical Analysis The script accepts `SENSEAUDIO_API_BASE` without validating its scheme or hostname. It then constructs the request URL from that value and sends an `Authorization: Bearer` header containing `SENSEAUDIO_API_KEY`. For synthesis operations, the JSON request body also includes the complete user-provided text and synthesis parameters. Consequently, a modified environment or untrusted runtime configuration can redirect authentication and synthesis requests to an attacker-controlled endpoint. Sending the API key and user text to the default official SenseAudio endpoint is necessary for the declared remote TTS functionality. Allowing those values to be sent to an arbitrary endpoint is not necessary and vio ...[truncated 1188 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `SENSEAUDIO_API_BASE` configurability if alternate endpoints are not required. 2. If configurability is required, parse the URL before sending any request and enforce: - The `https` scheme. - The exact approved hostname `api.senseaudio.cn`. - An expected or empty port. - Rejection of embedded credentials, fragments, and unexpected path components. 3. Construct the final endpoint from a fixed trusted origin and fixed API path rather than concatenating unrestricted strings. 4. Disable or carefully validate redirects so an approved endpoint cannot redirect a credential-bearing request to another host. 5. Never forward the `Authorization` header across a cross-origin redirect. 6. Document any supported alternate official endpoints and maintain an explicit allowlist. 7. Add tests confirming rejection of HTTP URLs, lookalike domains, localhost addresses, IP literals, user-info URL components, and unapproved ports. ]]>