T09 · Insecure Skill Coding Practices
Error
- Location
scripts/extractor.py:236- Finding
Unrestricted Transmission of HTML Content to a Configurable LLM Endpoint
- Content
View full analysis
max_html_chars: html_content = html_content[:max_html_chars] + "\n... (truncated)" template = prompt_template or self.DEFAULT_LLM_PROMPT prompt = template.format( fields=", ".join(fields), html_content=html_content, ) url = f"{base_url.rstrip('/')}/chat/completions" payload = json.dumps({ "model": model, "messages": [ {"role": "system", "content": "你是一个信息提取助手，只返回 JSON 格式结果。"}, {"role": "user", "content": prompt}, ], "temperature": 0.1, "max_tokens": 1024, }).encode("utf-8") headers = { "Content-Type": "application/json", } if api_key and api_key != "ollama": headers["Authorization"] = f"Bearer {api_key}" req = urllib.request.Request(url, data=payload, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=60) as resp: result = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis `extract_by_llm()` embeds the extractor's HTML input in an LLM prompt and sends it through an HTTP POST request. The destination can be selected directly with `base_url` or indirectly through `OPENAI_BASE_URL`. The implementation does not: - Restrict remote destinations to trusted providers. - Require TLS for non-loopback destinations. - Warn or request confirmation before sending document contents. - Redact credentials, personal information, or other sensitive values from HTML. - Bind an API key to a specific trusted origin. - Distinguish content loaded from a public URL from content loaded from a local ...[truncated 1770 chars]- Remediation
View remediation