other
Error
- Location
- v2/rerank.py:54
- Finding
- External Disclosure of Private Memory During Reranking<![CDATA[ ## Vulnerability Details **File Location**: `v2/rerank.py:54-68`, `v2/rerank.py:76-92`, and `v2/retrieval_hybrid.py:316-323` **Vulnerability Type**: Sensitive data disclosure to an external service **Risk Level**: High ### Complete Code Snippet ```python if provider == "jina": endpoint = os.getenv("MEMORY_PRO_RERANK_ENDPOINT", "https://api.jina.ai/v1/rerank") api_key = os.getenv("MEMORY_PRO_RERANK_API_KEY", "") model = os.getenv("MEMORY_PRO_RERANK_MODEL", "jina-reranker-v2-base-multilingual") headers = {"Content-Type": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" payload = { "model": model, "query": query, "documents": [c.get("sentence", "") for c in work], "top_n": topn, } r = requests.post(endpoint, json=payload, headers=headers, timeout=timeout_ms / 1000) r.raise_for_status() data = r.json() elif provider == "openai_compatible": endpoint = os.getenv("MEMORY_PRO_RERANK_ENDPOINT", "") api_key = os.getenv("MEMORY_PRO_RERANK_API_KEY", "") model = os.getenv("MEMORY_PRO_RERANK_MODEL", "") if not endpoint or not model: raise RuntimeError("openai_compatible rerank requires ENDPOINT and MODEL") headers = {"Content-Type": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" payload = { "model": model, "query": query, "documents": [c.get("sentence", "") for c in work], "top_n": topn, } r = requests.post(endpoint, json=payload, headers=headers, timeout=timeout_ms / 1000) ``` The external call is reached through hybrid retrieval: ```python # Optional rerank (Phase 3): timeout-safe + fallback rerank_meta = {"applied": False} try: from rerank import should_rerank, rerank_candidates if should_rerank(query): fused, rerank_meta = rerank_candidates(query, fused) except Exception: # fail-open: keep original fused ranking ...[truncated 2672 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Keep all reranking local by default and prefer an on-device reranking model. 2. Present an explicit warning and require informed user consent before enabling external reranking. 3. Document exactly which fields and how many candidate documents are transmitted. 4. Restrict endpoints to an administrator-controlled HTTPS allowlist. 5. Reject plain HTTP endpoints and URLs containing embedded credentials. 6. Reduce outbound candidates to the final requested `top_k`. 7. Add configurable source exclusions so core files and sensitive scopes cannot be transmitted. 8. Apply secret and personal-data redaction before constructing the request. 9. Consider sending minimized excerpts rather than complete sentences. 10. Log the destination and number of transmitted records without logging their contents. 11. Provide a strict local-only mode that prevents all outbound requests regardless of environment configuration. ]]>