T09 · Insecure Skill Coding Practices
Warning
- Location
- tools/sd_client.py:23
- Finding
- Unencrypted Transmission of Image Data to an Unrestricted Remote Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `tools/sd_client.py:23-39`, with image data entering outbound requests at `tools/sd_client.py:157-178`, `187-212`, `220-246`, `252-278`, and `283-290` **Vulnerability Type**: Unrestricted remote endpoint configuration and plaintext transmission of sensitive image data **Risk Level**: Medium ### Vulnerable Code ```python SD_WEBUI_URL = os.environ.get("SD_WEBUI_URL", "http://127.0.0.1:7860") SD_TIMEOUT = int(os.environ.get("SD_TIMEOUT", "300")) SD_OUTPUT_DIR = os.environ.get("SD_OUTPUT_DIR", "./sd_output") # ── Helpers ──────────────────────────────────────────────────────────────────── def api_get(endpoint: str) -> dict: url = f"{SD_WEBUI_URL.rstrip('/')}{endpoint}" resp = requests.get(url, timeout=30) resp.raise_for_status() return resp.json() def api_post(endpoint: str, payload: dict) -> dict: url = f"{SD_WEBUI_URL.rstrip('/')}{endpoint}" resp = requests.post(url, json=payload, timeout=SD_TIMEOUT) resp.raise_for_status() return resp.json() ``` For example, `img2img` reads a user-selected local file and includes it in a request to that endpoint: ```python def action_img2img(args): if not args.init_image: print("❌ 需要提供 --init-image 参数") sys.exit(1) payload = { "init_images": [img_to_b64(args.init_image)], "prompt": args.prompt or "", "negative_prompt": args.negative_prompt or "(worst quality:2),(low quality:2),blurry,ugly", "steps": args.steps, "cfg_scale": args.cfg_scale, "width": args.width, "height": args.height, "seed": args.seed, "batch_size": args.batch_size, "denoising_strength": args.denoising_strength, "sampler_name": args.sampler, "resize_mode": args.resize_mode, } print(f"🔄 正在图生图 (强度: {args.denoising_strength})...") result = api_post("/sdapi/v1/img2img", payload) images = result.get("images", []) info = json.loads(resu ...[truncated 3040 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `SD_WEBUI_URL` with `urllib.parse.urlparse` and reject malformed URLs, embedded credentials, fragments, and unsupported schemes. 2. Permit loopback destinations by default. Require an explicit option such as `--allow-remote-webui` before connecting to non-loopback addresses. 3. Require HTTPS for non-loopback destinations. If plaintext remote HTTP must be supported, require an explicit high-visibility override and warn that images and prompts will be exposed in transit. 4. Disable automatic redirects with `allow_redirects=False`, or validate the scheme and resolved destination of every redirect before following it. 5. Consider resolving hostnames and rejecting loopback, private, link-local, multicast, and cloud metadata addresses when remote access is not part of the intended policy. 6. Display the final destination and the categories of data that will be transmitted before the first remote image request. 7. Add optional authentication support without placing credentials in URLs or logs. 8. Set maximum source-file and response sizes before reading, decoding, or saving image data to reduce resource-exhaustion exposure. 9. Document that Base64 does not encrypt content and that remote deployments must use authenticated TLS. ]]>