T09 · Insecure Skill Coding Practices
Warning
- Location
tools/sd_client.py:23- Finding
Unencrypted Transmission of Image Data to an Unrestricted Remote Endpoint
- Content
View full analysis
dict: url = f"{SD_WEBUI_URL.rstrip('/')}{endpoint}" resp = requests.get(url, timeout=30) resp.raise_for_status() return resp.json() def api_post(endpoint: str, payload: dict) -> dict: url = f"{SD_WEBUI_URL.rstrip('/')}{endpoint}" resp = requests.post(url, json=payload, timeout=SD_TIMEOUT) resp.raise_for_status() return resp.json() ``` For example, `img2img` reads a user-selected local file and includes it in a request to that endpoint: ```python def action_img2img(args): if not args.init_image: print("❌ 需要提供 --init-image 参数") sys.exit(1) payload = { "init_images": [img_to_b64(args.init_image)], "prompt": args.prompt or "", "negative_prompt": args.negative_prompt or "(worst quality:2),(low quality:2),blurry,ugly", "steps": args.steps, "cfg_scale": args.cfg_scale, "width": args.width, "height": args.height, "seed": args.seed, "batch_size": args.batch_size, "denoising_strength": args.denoising_strength, "sampler_name": args.sampler, "resize_mode": args.resize_mode, } print(f"🔄 正在图生图 (强度: {args.denoising_strength})...") result = api_post("/sdapi/v1/img2img", payload) images = result.get("images", []) info = json.loads(resu ...[truncated 3040 chars]- Remediation
View remediation