T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/seedream_image_generate.py:43
- Finding
- Unvalidated API Endpoint Override Can Expose Bearer Credentials and User Data## Vulnerability Details **File Location**: `scripts/seedream_image_generate.py`, lines 43-47, 77-83, and 103-107 **Vulnerability Type**: Unvalidated API endpoint configuration and credential disclosure **Risk Level**: High ### Vulnerable Code ```python API_KEY = os.getenv("ARK_DOLA_API_KEY") API_BASE = os.getenv( "ARK_DOLA_API_BASE", "https://ark.ap-southeast.bytepluses.com/api/v3" ).rstrip("/") ``` ```python def _get_headers() -> dict: if not API_KEY: raise ValueError("Missing ARK_DOLA_API_KEY environment variable.") return { "Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}", } ``` ```python async def _call_image_api(client: httpx.AsyncClient, item: dict, model_name: str, version: str) -> dict: url = f"{API_BASE}/images/generations" body = _build_request_body(item, model_name, version) response = await client.post(url, headers=_get_headers(), json=body) ``` ### Technical Analysis The destination API base URL is read directly from the `ARK_DOLA_API_BASE` environment variable without validating its scheme, hostname, port, or trust boundary. The same request unconditionally includes the secret from `ARK_DOLA_API_KEY` in the `Authorization` header. Consequently, a malicious or incorrectly configured environment can redirect requests to an attacker-controlled origin. The resulting request contains the bearer credential and generation payload, including user prompts and any supplied reference-image URLs. A non-HTTPS endpoint could also expose this information to network interception. The HTTP client's ordinary TLS verification protects connections only when HTTPS is used; it does not establish that the selected destination is an authorized BytePlus endpoint. The endpoint override is also not documented in `SKILL.md`, reducing the likelihood that users will recognize an unsafe inherited configura ...[truncated 1691 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `ARK_DOLA_API_BASE` override if custom API endpoints are not an explicit requirement, and use a fixed trusted BytePlus HTTPS endpoint. 2. If endpoint customization is required, parse the configured value with a URL parser and enforce: - The `https` scheme. - An explicit allowlist of trusted BytePlus hostnames. - Expected ports only. - Rejection of embedded credentials, fragments, malformed URLs, and unexpected IP literals. 3. Generate and attach the `Authorization` header only after confirming that the final request origin is trusted. 4. Disable or tightly validate redirects so credentials cannot be forwarded to another origin. Prefer rejecting redirects for authenticated API requests. 5. Fail closed with a clear error when endpoint validation fails. 6. Document the endpoint configuration, its security constraints, and the sensitivity of inherited environment variables. 7. Use narrowly scoped API credentials with appropriate quotas, rotation procedures, monitoring, and revocation support to limit the impact of credential disclosure. A hardened validation pattern should resemble: ```python from urllib.parse import urlparse TRUSTED_API_HOSTS = {"ark.ap-southeast.bytepluses.com"} def validate_api_base(value: str) -> str: parsed = urlparse(value) if ( parsed.scheme != "https" or parsed.hostname not in TRUSTED_API_HOSTS or parsed.username is not None or parsed.password is not None or parsed.fragment ): raise ValueError("ARK_DOLA_API_BASE is not an approved HTTPS endpoint.") return value.rstrip("/") ``` The HTTP client should additionally reject redirects or ensure that authorization information is never sent across origins.