T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/minimax_image.py:42- Finding
Unrestricted Local File Upload to an External API
- Content
View full analysis
str: """Read local image file and return base64 data URL.""" if not os.path.exists(path): # Try expanding path for Windows paths like D:\... if sys.platform == 'win32' and ':' in path: # Try as-is pass print(f"Error: File not found: {path}", file=sys.stderr) sys.exit(1) # Detect format from extension lower_path = path.lower() if lower_path.endswith('.png'): fmt = 'png' elif lower_path.endswith('.webp'): fmt = 'webp' elif lower_path.endswith('.jpg') or lower_path.endswith('.jpeg'): fmt = 'jpeg' else: fmt = 'jpeg' # default try: with open(path, 'rb') as f: image_data = f.read() b64_data = base64.b64encode(image_data).decode('utf-8') return f"data:image/{fmt};base64,{b64_data}" except IOError as e: print(f"Error reading file: {e}", file=sys.stderr) sys.exit(1) def process_image_url(image_url: str) -> str: """ Process image input and convert to base64 data URL. Handles: - HTTP/HTTPS URLs: downloads and converts to base64 - Local file paths: reads file and converts to base64 - Base64 data URLs: passes through as-is """ if image_url.startswith('data:'): # Already a data URL return image_url elif image_url.startswith(('http://', 'https://')): return download_image_as_base64(image_url) else: # Local file path return local_file_to_base64(image_url) def call_vlm_api(api_key: str, prompt: str, image_url: str) -> dict: """Call MiniMax VLM API.""" # Process image (convert to base64 if needed) processed_image_url = proces ...[truncated 2477 chars]- Remediation
View remediation