T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/generation_api.py:101
- Finding
- API Key Disclosure Through Cross-Origin HTTP Redirects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generation_api.py:101-106, 166-182` **Vulnerability Type**: Sensitive authentication header forwarded through redirects **Risk Level**: Medium ### Vulnerable Code ```python def __init__(self, api_key: str): self.api_key = api_key self.headers = { "x-auth": api_key, "Content-Type": "application/json" } ``` ```python def _post(self, path: str, payload: Dict[str, Any]) -> Dict[str, Any]: url = f"{self.BASE_URL}{path}" try: resp = requests.post(url, headers=self.headers, json=payload, timeout=30) resp.raise_for_status() result = resp.json() if result.get("code") != 200: raise Exception(result.get("msg", result.get("message", "未知错误"))) return result except requests.exceptions.RequestException as e: raise Exception(f"请求失败: {str(e)}") def query_task(self, task_id: str) -> Dict[str, Any]: """查询任务状态""" url = f"{self.BASE_URL}{self.QUERY_TASK}" try: resp = requests.get( url, headers=self.headers, params={"task_id": task_id}, timeout=30 ) ``` ### Technical Analysis The Skill must transmit `GIGGLE_API_KEY` to `https://giggle.pro` to authenticate video-generation operations, so sending the credential to that declared service is necessary for the advertised functionality. However, the credential is placed in the custom `x-auth` header, and both Requests calls use the library's default redirect behavior. Redirects are followed automatically because `allow_redirects=False` is not specified. Requests has special handling for removing the standard `Authorization` header when redirecting across origins, but an application-defined authentication header such as `x-auth` does not receive equivalent protection automatically. Consequently, a cross-origin redirect may cause the API key to be sent to the redirected host. This exceeds minimum ...[truncated 1429 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable redirects on authenticated API requests: ```python resp = requests.post( url, headers=self.headers, json=payload, timeout=30, allow_redirects=False, ) ``` ```python resp = requests.get( url, headers=self.headers, params={"task_id": task_id}, timeout=30, allow_redirects=False, ) ``` 2. Treat any redirect as an error unless it is explicitly required by the API contract. 3. If redirects must be supported, process them manually and validate all of the following before issuing another request: - The scheme remains `https`. - The hostname exactly matches an approved allowlist. - The destination port is approved. - No user-information component is present in the URL. 4. Remove `x-auth` before following any cross-origin redirect, even when the new host is otherwise trusted. 5. Store the API key only in the environment and avoid including it in exceptions, logs, or command output. 6. Add an automated test that redirects an authenticated request to a local second origin and verifies that the second origin never receives `x-auth`. ]]>