T09 · Insecure Skill Coding Practices
Error
- Location
scripts/noiz_tts.py:42- Finding
Arbitrary API Base URL Enables Disclosure of API Keys and User Content
- Content
View full analysis
str: resp = requests.post( f"{base_url.rstrip('/')}/emotion-enhance", headers={"Authorization": api_key, "Content-Type": "application/json"}, json={"text": text}, timeout=timeout, ) ``` ```python try: resp = requests.post( url, headers={"Authorization": api_key}, data=data, files=files, timeout=timeout, ) finally: if files and files["file"][1]: files["file"][1].close() ``` ```python parser.add_argument("--base-url", default="https://noiz.ai/v1") ``` The timeline renderer contains the same design: ```python ap.add_argument("--base-url", default="https://noiz.ai/v1") ``` ```python resp = requests.post( url, headers={"Authorization": api_key}, data=payload, files=files, timeout=timeout, ) ``` ### Technical Analysis The scripts accept an unrestricted `--base-url` argument and construct authenticated HTTP requests from it. They do not require HTTPS, verify that the destination belongs to Noiz, or prevent redirects to another origin. Consequently, the `Authorization` value is not bound to the documented Noiz endpoint. User text, emotion-enhancement requests, and uploaded reference audio are also sent to the selected destination. Base64 normalization of the key does not provide confidentiality because base64 is reversible encoding rather than encryption. This network configurability exceeds the minimum privileges necessary for the documented Noiz TTS integration. A legitimate implementation only needs access to the expected Noiz API origin. ### Attack Path 1. An attac ...[truncated 1120 chars]- Remediation
View remediation