other
Warning
- Location
- scripts/image_generator.py:54
- Finding
- Undisclosed Persistent Host Identifier Transmitted to a Third-Party Service## Vulnerability Details **File Location**: `scripts/image_generator.py`, lines 22–23, 54–67, and 112–114 **Vulnerability Type**: Undisclosed environment reconnaissance and persistent activity tracking **Risk Level**: Medium ### Complete Code Snippet ```python SETTINGS_PATH = Path.home() / '.deepcode-plus' / 'settings.json' MACHINE_ID_PATH = Path.home() / '.deepcode' / 'machine-id' ``` ```python def get_machine_id() -> str | None: try: if MACHINE_ID_PATH.exists(): machine_id = MACHINE_ID_PATH.read_text(encoding='utf-8').strip() if machine_id: return machine_id random_part = secrets.token_hex(8) timestamp = int(time.time() * 1000) machine_id = f'{socket.gethostname()}-{random_part}-{timestamp}' MACHINE_ID_PATH.parent.mkdir(parents=True, exist_ok=True) MACHINE_ID_PATH.write_text(machine_id, encoding='utf-8') return machine_id except OSError: return None ``` ```python headers = {'Content-Type': 'application/json'} if api_key: headers['PLUS-API-KEY'] = api_key if machine_id := get_machine_id(): headers['Token'] = machine_id ``` ### Technical Analysis The script obtains the local hostname through `socket.gethostname()`, combines it with a random value and timestamp, and writes the resulting identifier to `~/.deepcode/machine-id`. On subsequent executions, the same value is read from disk and transmitted in the `Token` HTTP header to `deepcode.vegamo.cn`. This behavior occurs inside the common `request_json()` function, meaning the identifier is sent during both anonymous cost calculations and authenticated image-generation requests. Consequently, the remote service can correlate pre-authentication and authenticated activity across separate executions. The hostname collection is a limited form of environment reconnaissance. A hostname may reveal a username, employee identi ...[truncated 2795 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `get_machine_id()` and the `Token` header if device identification is not strictly required by the service. 2. Do not include `socket.gethostname()` or other local environment information in any identifier sent over the network. 3. If a client identifier is operationally necessary, generate a cryptographically random identifier containing no hostname, username, timestamp, path, or other device metadata. 4. Make persistent identification opt-in and clearly document: - The exact information collected. - Its purpose. - The destination service. - How long it persists. - How users can inspect, reset, or disable it. 5. Do not transmit a persistent identifier during anonymous cost calculations unless it is demonstrably required. 6. Prefer short-lived, request-scoped identifiers over values stored across sessions. 7. Store any approved persistent identifier in the Skill's documented configuration directory with restrictive file permissions. 8. Add tests confirming that cost and generation requests contain only documented headers and do not disclose hostname or other local environment metadata. 9. Update `SKILL.md` with an accurate privacy and network-data disclosure if any telemetry remains after remediation.