T09 · Insecure Skill Coding Practices
Error
- Location
scripts/voiceclone.py:49- Finding
Plaintext HTTP Transmission of Credentials, Access Tokens, and Biometric Voice Data
- Content
View full analysis
dict: return { "X-Sign": sign, "X-Token": self.token, "X-AppId": self.app_id, "X-Time": str(self._ts), "Content-Type": "application/json", } def _post(self, path: str, body: dict) -> dict: """POST JSON to training API.""" self._ensure_token() sign = self._sign_body(body) headers = self._headers(sign) data = json.dumps(body).encode("utf-8") req = urllib.request.Request( TRAIN_BASE_URL + path, data=data, headers=headers, ) with urllib.request.urlopen(req, timeout=60) as resp: return json.loads(resp.read().decode("utf-8")) ``` Local biometric voice recordings are also loaded and transmitted to the plaintext training endpoint: ```python with open(audio_path, "rb") as f: audio_data = f.read() ``` ```python headers = { "X-Sign": sign, "X-Token": self.token, "X-AppId": self.app_id, "X-Time": str(ts), "Content-Type": f"multipart/form-data; boundary={boundary}", } req = urllib.request.Request( TRAIN_BASE_URL + "/task/submitWithAudio", data=body_bytes, hea ...[truncated 2584 chars]- Remediation
View remediation