T09 · Insecure Skill Coding Practices
Error
- Location
scripts/image_provider.py:177- Finding
Configurable API endpoints can expose bearer credentials and user images
- Content
View full analysis
str: base_url = self._require_env("MINIMAX_BASE_URL").rstrip("/") parsed = urlparse(base_url) if not parsed.scheme or not parsed.netloc: raise RuntimeError(f"MINIMAX_BASE_URL is invalid: {base_url}") return base_url def _resolve_text_url(self) -> str: text_url = _normalize_env_value(os.environ.get("MINIMAX_TEXT_LLM_URL", "")) if text_url: parsed = urlparse(text_url) if not parsed.scheme or not parsed.netloc: raise RuntimeError(f"MINIMAX_TEXT_LLM_URL is invalid: {text_url}") return text_url.rstrip("/") return f"{self._resolve_base_url()}/anthropic" def _resolve_image_url(self) -> str: image_url = _normalize_env_value(os.environ.get("MINIMAX_IMAGE_URL", "")) if image_url: parsed = urlparse(image_url) if not parsed.scheme or not parsed.netloc: raise RuntimeError(f"MINIMAX_IMAGE_URL is invalid: {image_url}") return image_url return f"{self._resolve_base_url()}/v1/image_generation" ``` Reference images are serialized and included in the request: ```python def _prepare_reference(self, input_images: Optional[List[str]] = None) -> Optional[List[dict]]: if not input_images: return None refs = [] for img in input_images: if img.startswith("http") or img.startswith("data:"): refs.append({"type": "character", "image_file": img}) else: data_url = image_to_data_url(img) if data_url: refs.append({"type": "character", "image_file": data_url}) else: print(f"Failed to convert reference image to data URL: {img}") return refs or None ``` The API credentia ...[truncated 2908 chars]- Remediation
View remediation